Hi, I'm looking to grab numbers of http responses (status) as "Good" or "Bad" and am successful with the following query in which I can get Total number of Responses, number of Good/Bad Responses, and what the percentages of Good/Bad Responses out of Total: (index="A" OR index="B") (host="A") | stats count as Total, count(eval(tonumber(status)>=400)) as "Bad_Request" , count(eval(tonumber(status)<=399)) as "Good_Request" | eval Bad_Request_Perc=((Bad_Request/Total)*100) | eval Good_Request_Perc=((Good_Request/Total)*100) However, when trying to exclude specific values to one range and adding values, I am able to retrieve "Bad_Requests" and respective percentage, but unable to retrieve any values for "Good_Requests" (and consequently percentage), using the following: (index="A" OR index="B") (host="A") | stats count as Total, count(eval(status>=400 AND status!=404 AND status!=410)) as "Bad_Request", count(eval(status<=399 AND status=404 AND status=410)) as "Good_Request" | eval Good_Request_Percentage=((Good_Request/Total)*100) | eval Bad_Request_Percentage=((Bad_Request/Total)*100) Does anyone know why I can get results excluding from a range, but can't get results specifying a range and specific values? Thanks. ... View more

Hi all, Looking to measure cache hit rate percentage of a source/sources, listing time, source, cache hit, total hits, and cache hit rate. All fields return the information I need, except for the time field, which returns results in seconds. Using time picker also returns the same results. Is there a way to provide broader data cuts than seconds? Thanks! index="[myIndex]" source="[mySource]" status!=null earliest=-15m@h latest=now | stats count as total by source, time | appendcols [search index="[myIndex]" source="[mySource]" cache=HIT earliest=-15m@m latest=now | stats count as hit by source, time ]| eval perc=round((hit/total)*100,2) | fields time,source,hit,total,perc ... View more