how to do group by daily percentage

[dhavamanis]

Can you please tell me, how to do daily percentage, here is the overall percentage query,

index="idxweblog" source="/opt/apache2/logs/surf.nbcuni.com-access_log" c=cnbc "/api/login" | eval rt9xxms=if(duration > 900000,1,0)  | stats sum(rt9xxms) as rt9xxms count(duration) as Total | eval rt9xxmsPercentage=(Total - rt9xxms)*100/Total | eval rthighPercentage=(100-rt9xxmsPercentage)

[dhavamanis]

seems this query works for me, is there any other way to get this shortly.

index="idxweblog" source="/opt/apache2/logs/surf.nbcuni.com-access_log" c=cnbc "/api/login" | bin _time span=1d | eval rt9xxms=if(duration <= 900000,1,0) | stats sum(rt9xxms) as rt9xxms count(duration) as Total by _time | eval rt9xxmsPercentage=(Total - rt9xxms)*100/Total | eval rthighPercentage=(100-rt9xxmsPercentage) | table _time, rthighPercentage

[somesoni2 · Accepted solution]

Try this

index="idxweblog" source="/opt/apache2/logs/surf.nbcuni.com-access_log" c=cnbc "/api/login"  | bucket span=1d _time | eval rt9xxms=if(duration > 900000,1,0)  | stats sum(rt9xxms) as rt9xxms count(duration) as Total by _time | eval rt9xxmsPercentage=(Total - rt9xxms)*100/Total | eval rthighPercentage=(100-rt9xxmsPercentage) 

THis will give you the percentage day-wise (_time will be set as YYYY-mm-dd 00:00 AM). If you want to format _time, add following to above search:-

above search | eval Date=strftime(_time,"%Y-%m-%d") | fields - _time

[dhavamanis]

how to add this with timechar with formatted date? we can take only two column _time and rthighPercentage.

[dhavamanis]

this query working formore than a day. if we choose a particular day, seems its giving blank entries. can you please correct this query to avoid blank entries.

index="idxweblog" source="/opt/apache2/logs/surf.nbcuni.com-access_log" c=cnbc "/api/login" | bucket _time span=1d | top duration limit=0 by _time | where duration <= 900000 |timechart sum(percent) as reliability