@rahuljchavan you can try below: Query will display error & success percentage both. | rex field=_raw "(?ms)^[^\"\\n]*\"(?P<http_method>\\w+)\\s+((?P<path>/[a-zA-Z0-9-_/=]*).*) (?P<http_ver>[^\"]+)\"\\s+(?P<status_code>\\d+)" offset_field=_extracted_fields_bounds
| rex field=_raw "(?ms)^[^\"\\n]*\"(?P<http_method>\\w+)\\s+((?P<path>/imgproxy/*).*) (?P<http_ver>[^\"]+)\"\\s+(?P<status_code>\\d+)" offset_field=_extracted_fields_bounds
| eval endpoint=http_method." ".path
| where like(path, "/info%") OR like(path, "/status%") OR like(path, "/imgproxy%") OR like(path, "/error%") OR like(path, "/rest/suite/%")
| eval result=if(status_code>299,"error","success")
| stats count count(eval(result="success")) as success_count count(eval(result="error")) as error_count by endpoint
| eval error_perc=(error_count/count)*100,success_perc=(success_count/count)*100
| table endpoint,error_perc,success_perc
... View more