Hi, With fields named url and status, you can use the chart command to count over url by status: | chart count over url by status url 200 404 / 123 0 /broken 0 3   You can rename fields and modify field values to adjust table column names: | rename url as "Requested Url" | eval status="responseStatus=".status | chart count over "Requested Url" by status Requested Url responseStatus=200 responseStatus=404 / 123 0 /broken 0 3   In either case, your base search should include your target events: index=foo environment=A client=x | rename url as "Requested Url" | eval status="responseStatus=".status | chart count over "Requested Url" by status  You can improve performance by adding indexed fields like source and sourcetype to your base search, using accelerated data models, etc., but those are topics best left to a new question. ... View more

yes it worked  @ITWhisperer Thanks. ... View more

Hi @bowesmana  Thanks and it worked. ... View more

| eval slow=if(response>10000,1,0) | bin _time span=1h | stats count sum(slow) as slow by _time | eval tooslow=100*slow/count | where tooslow>2 ... View more

Remove the "%" from successrate.  Add | where successrate < 98 to the end of the query.  If necessary, you can use an eval after that to put the "%" back.  Configure the alert to trigger if there are more than zero results returned by the query. ... View more

| where successrate < 95 If you get any results, raise an alert ... View more

When you paste your log entries, put them in a code sample by clicking on this symbol so we can see exactly what you have because the rex expression should have worked based on what you had pasted earlier. ... View more