Hi There,
Need help to find the status code error rate where status code is >400.
I have below Query to time chart the error rate , which works fine...
Add | fields ErrorRate to the end of the query.
For an alert, replace timechart with stats and eval.
index=apache_core userAgent!="nginx/*" source="*access.log*" requestURI!="/web/app*" NOT (requestURI="/api/xyz/*" OR requestURI="/api/yyy/*" AND statusCode=404) earliest=-30m latest=now
| stats count(eval(statusCode>=400)) as errors, count as total
| eval ErrorRate = errors * 100 / total
Thanks! for the reply . It works , but I want only "ErrorRate" to be displayed.
Right now , it displays like this.
errors total ErrorRate
19056 679878 2.8028558064829276
Add | fields ErrorRate to the end of the query.