Timespan based output

[poddraj]

Hi
Can someone help me in getting o/p over 1h interval along with Total requests count, Success count, Failure count

I have written below query but am not getting the Total count as separate column for every 1h interval span

index=dte_fios sourcetype=dte2_Fios FT=*FT | eval Interval=strftime('_time',"%d-%m-%Y %H:%M:%S")
| eval Status=case(Error_Code=="0000","Success",1=1,"Failure")
| timechart span=1h count by Status

It is giving O/p as
_time Success Failure
2020-04-20 05:00 120 90

I need O/P as
_time Total Failure Success
2020-04-20 05:00 210 90 120

[richgalloway · Accepted solution]

You're not getting the total count because your query does not mention total count.

index=dte_fios sourcetype=dte2_Fios FT=*FT 
| eval Status=case(Error_Code=="0000","Success",1=1,"Failure")
| timechart span=1h count by Status
| eval Total = Success + Failure
| table _time Total Failure Success

[poddraj]

Thanks....