Seems pretty simple, but it's kicking my butt so here I am. I've tried more variations than I'd like, but I have a ton of log writes. some of them are response values. What I'd like to do is create a...
See more...
Seems pretty simple, but it's kicking my butt so here I am. I've tried more variations than I'd like, but I have a ton of log writes. some of them are response values. What I'd like to do is create a simple table displaying the URL, its total number of incoming requests, and its total number of error responses. I can't get the error responses to work properly. In the latest iteration, this is what I have: ... line.status != "" | stats count as total_requests by line.url | eventstats count(eval(line.status!="200")) as errors by line.url line.status doesn't exist on ever log write, of course, so I want to search only on log writes that document a response - for those, line.status will exist. total_requests works as expected, but errors does not. Ideally, errors could be a count where line.status > 399, but the value is a string and nothing I've tried has worked properly. I either get a query error, a 0 value, or a 1 value for all line.url values. Where am I going wrong here?