Remove all the ticks/quotes from the field names in your SPL - for what you are doing they aren't necessary. I only quote my field names if they have any negative space characters. Once I did that ...
See more...
Remove all the ticks/quotes from the field names in your SPL - for what you are doing they aren't necessary. I only quote my field names if they have any negative space characters. Once I did that I was able to "fake" your search in my environment and get results: index=_internal status=*
| rename status AS HTTPStatus
| stats count(eval(HTTPStatus >= 400 AND HTTPStatus < 500)) AS fourxxErrors, count(eval(HTTPStatus >= 500 AND HTTPStatus < 600)) AS fivexxErrors, count AS TotalRequests
| eval fourxxPercentage = if(TotalRequests > 0, (fourxxErrors / TotalRequests) * 100, 0), fivexxPercentage = if(TotalRequests > 0, (fivexxErrors / TotalRequests) * 100, 0)
| table fourxxPercentage, fivexxPercentage Also, I just added this at the beginning to turn misc data in _internal into events that "look" like yours for this example purpose: index=_internal status=*
| rename status AS HTTPStatus