calculating field percentages before stats command

[amerineni]

index= base search | stats count, avg(ElapsedTime) as duration,  by requestName, LogType, errorMessage, HttpStatus, isValidError

is there anyway i can calculate the success percent of each requestName field based on HttpStatus values(<299 success and >299 failure) before executing stats command and then include that in the result table?

Appreciate any help.

[isoutamo]

Hi

You could try this:

index=base search 
| eval h_ok=if(HttpStatus < 299, 1, 0)
| eval h_nok=if(HttpStatus > 299, 1, 0)
| stats sum(h_ok) as h_ok, sum(h_nok) as h_nok, count, avg(ElapsedTime) as duration,  by requestName, LogType, errorMessage, HttpStatus, isValidError
| eval h_per_ok = round(h_ok/(h_ok + h_nok),2)*100, h_per_nok = round(h_nok/(h_ok+h_nok),2)
| table h_per_ok, h_per_nok, requestName, ....

[amerineni]

thanks for the quick response. 

My data looks like this

requestName1     logType1  errorMessage1

requestName1     logType1  errorMessage2

the query you suggested returns different success percent for the above two combinations. However i want to populate a column with total success percent for "request1" not individual combinations success percents. Hope explained what i need correctly. 

I'm doing a sub query to calculate to percentages and then joining now. Wanted to know if there is a better way. Thanks.

[anmolpatel]

@amerineni  this should provide the guidance on what you need

| makeresults
| eval _raw="HttpStatus, isValidError
200, false
200, false
201, false
305, true
202, false
400, true
500, true"
| multikv forceheader=1
| rename COMMENT AS "CHECK THE CODE FROM HERE ON"
| eval result = if(HttpStatus < 299, 1, 0)
| eventstats count as TotalSuccessFailure by result
| eventstats count as TotalEvents
| eval percent = round((TotalSuccessFailure / TotalEvents) * 100,1)
| rename COMMENT AS "CHECK THE CODE ABOVE HERE"
| fields HttpStatus result TotalSuccessFailure TotalEvents percent

you can than take it further and just get the score by using stats

| stats values(percent) by result