Hi all,
A though one for me, but maybe an easy one for you! I want to count error messages and show it in a table per size range.
Please 'enhance' the command: index="myindex" source="mysource" host="myhost" [your-magic]
I appreciate any creative ideas as long as it looks similarish as below 🙂
Output:
Message Size (KB) failure debug error NOT failure/debug/error
0-100 13 21 0 3939
100-200 10 16 0 3
200-500 52 6 3 0
500-1000 29 2 35 5
>1000 0 0 58 0
Cheers,
Martin
you can easily create that table by following these steps:
Here's an example:
.... | eval ms=len(_raw) | eval MessageSize=if(ms<100, "0-100", if(ms<200, "100-200", ">200")) | chart count over MessageSize by log_level
you can easily create that table by following these steps:
Here's an example:
.... | eval ms=len(_raw) | eval MessageSize=if(ms<100, "0-100", if(ms<200, "100-200", ">200")) | chart count over MessageSize by log_level