calculate percentage of a each ErrorCode field by servername

[indeed_2000]

Hi

how can I calculate percentage of a each ErrorCode field by servername?

here is the spl:

index="my_index"
| rex field=source "\/log\.(?<servername>\w+)."
| rex "Err\-ErrorCode\[(?<ErrorCode>\d+)"

expected output:

Servername     ErrorCode      Percentage 

server1             404                    50%

                             500                    40%

                             200                    10%

server2             500                    50%

                             404                    45%

                             200                    5%

…

any idea?

 Thanks 

[ITWhisperer · Accepted solution]

index="my_index"
| rex field=source "\/log\.(?<servername>\w+)."
| rex "Err\-ErrorCode\[(?<ErrorCode>\d+)"
| eventstats count as servercount by servername
| stats count as errorcount values(servercount) as servercount by servername ErrorCode
| eval Percentage=round(100*errorcount/servercount,2)
| table servername ErrorCode Percentage

[indeed_2000]

Thank you for answer, is it possible to add count, like below?

Servername     ErrorCode      Percentage      count

server1                 404                    50%                       456

[ITWhisperer]

Just add it to the table command

| table servername ErrorCode Percentage errorcount