Stats StatusCode error Rate

[dpdwibedy]

Hi There,

Need help to find the  status code error rate  where  status code is >400.

I have below Query to time chart the error rate  , which works fine...

index=apache_core  userAgent!="nginx/*" source="*access.log*"  requestURI!="/web/app*" NOT (requestURI="/api/xyz/*"  OR requestURI="/api/yyy/*"  AND statusCode=404) earliest=-30m latest=now | timechart span=5m limit=0 eval((count(eval(statusCode>=400)) / count()) * 100) as ErrorRate

But , to  create an alert , I don't want the time chart  , just the  error rate  in last 30 mins.

the stats count with the eval statement doesn't work.

Thanks,

DD

[richgalloway]

For an alert, replace timechart with stats and eval.

index=apache_core  userAgent!="nginx/*" source="*access.log*"  requestURI!="/web/app*" NOT (requestURI="/api/xyz/*"  OR requestURI="/api/yyy/*"  AND statusCode=404) earliest=-30m latest=now 
| stats count(eval(statusCode>=400)) as errors, count as total
| eval ErrorRate = errors * 100 / total

[dpdwibedy]

@richgalloway  ,

Thanks! for  the reply . It works , but I want only "ErrorRate" to be displayed.

Right now , it displays like this.

errors	total	ErrorRate
19056	679878	2.8028558064829276

[richgalloway · Accepted solution]

Add | fields ErrorRate to the end of the query.

[dpdwibedy]

Thanks @richgalloway . Appreciated.

Regards,

DD