query for percentage with count

[asplunk123]

I am trying to write a search, like Requests per second and its percentage based on total count. Please help me out in this. Thank you...

[somesoni2 · Accepted solution]

Try this

 index=someindex "priceRequest" |rex "some-app/(?<methodName>[a-zA-Z]*)" | rex "processingTime: (?<RTIME>[0-9]*)" | eval RTIME_SEC=(RTIME/1000) | eval group = case(RTIME_SEC < 1, "1 sec", RTIME_SEC < 2,"2 sec", RTIME_SEC < 3,"3 sec", RTIME_SEC < 4,"4 sec",RTIME_SEC < 5,"5 sec",RTIME_SEC < 6,"6 sec",RTIME_SEC>6,"Time Out")| stats count by group,methodName| eventstats sum(count) as total by methodName | eval Perc=round(count*100/total,2) | chart values(count) values(Perc) over group by methodName | appendpipe [| stats sum(*) as *  | eval group="Total" | table group *]

[asplunk123]

@somesoni2, yes i mean , interchange the columns.

here having 2 requests like priceRequest & priceResponse. actually having query for 1,2 columns are percentages of both requests and 3,4 column are count of both requests respectively. But i am expecting the query as like as Count(priceRequest ) Percentage(priceRequest ) Count(priceResponse) Percentage(priceResponse) respectively...

[asplunk123]

@somesoni2, Please help me out here for interchange the location of fields

[somesoni2]

Not sure if I understand what you need? What is the search that you're trying (before the appendpipe) and what is the fieldnames that you see?

[asplunk123]

how to add the Total field (row) in bottom of all adding all column values

[somesoni2]

You can use addcoltotals command for that. (add to the end)