Hi @mwolfe , don't use sum but count: index=web uri_path="/somepath" status="200" OR status="400"
| rex field=useragent "^(?<app_name>[^/]+)/(?<app_version>[^;]+)?\((?<app_platform>[^;]+); *"
| ev...
See more...
Hi @mwolfe , don't use sum but count: index=web uri_path="/somepath" status="200" OR status="400"
| rex field=useragent "^(?<app_name>[^/]+)/(?<app_version>[^;]+)?\((?<app_platform>[^;]+); *"
| eval app=app_platform+" "+app_name+" "+app_version
| eval success=if(status=200,1,0)
| eval failure=if(status=400,1,0)
| stats
count(failure) AS fail_count
count(success) AS success_count
BY app
| eval success_rate=round((success_count / (success_count + fail_count))*100,1)
| table app success_rate otherwise, you could insert the eval in the stats: index=web uri_path="/somepath" status="200" OR status="400"
| rex field=useragent "^(?<app_name>[^/]+)/(?<app_version>[^;]+)?\((?<app_platform>[^;]+); *"
| eval app=app_platform+" "+app_name+" "+app_version
| stats
count(eval(status=400)) AS fail_count
count(eval(status=200)) AS success_count
BY app
| eval success_rate=round((success_count / (success_count + fail_count))*100,1)
| table app success_rate Ciao. Giuseppe