Hi,
I am trying to calculate the percentage of two fields however the Perc filed is not being anything back:
Index=test sourcetype=Iis
|table response_time
|eval ResponseTime=response_time/1000
|eval isOver3s=if(ResponseTime>3,1,0)
|eval Perc=round((isOver3s/Event)*100,2)
|eventstats count as Event| stats Values(Event),sum(isOver3s)
|table Event, isOver3s, Perc
Any advice would be greatly appreciated.
thanks,
Joe
Eventstats to count the events needs to be before the eval that uses it.
Index=test sourcetype=Iis
|table response_time
|eval ResponseTime=response_time/1000
|eval isOver3s=if(ResponseTime>3,1,0)
|eventstats count as Event
|eval Perc=round((isOver3s/Event)*100,2)
|stats Values(Event),sum(isOver3s)
|table Event, isOver3s, Perc
Eventstats to count the events needs to be before the eval that uses it.
Index=test sourcetype=Iis
|table response_time
|eval ResponseTime=response_time/1000
|eval isOver3s=if(ResponseTime>3,1,0)
|eventstats count as Event
|eval Perc=round((isOver3s/Event)*100,2)
|stats Values(Event),sum(isOver3s)
|table Event, isOver3s, Perc
Hi,
I have tried this and works for the percentage however removes the events for isover3seconds.
Any thoughts?
|stats Values(Event),sum(isOver3s),sum(Perc)