Hi Experts,
I have a query which finds total number of non 200 responses and total responses based on the web access.logs by api and application location.
Now i need to group/club/count all the non 200 requests as 1 which happen within 10 seconds(for a location, api, application) as they are the results of the same problem.
index=web api=www.something.com | stats count as TOTAL count(eval(sc_status!=200)) as TOTAL_NON_200 count(eval(sc_status=404)) as TOTAL_404 by api location application
I saw on other answers that i can group using streamstats , not sure how that would fit in my case. Can i get some help ?
