Hi, Thank you! You are correct, I had miscalculated this. I have changed the query so it minuses 400 and 5xx failures from all calls (not just successful). It is a little longwinded but it shows the workings. Noted about the substr being unnecessary too, thank you for pointing it out. In this line, are any 400 failures being included? eval successfulCall=if('httpstatus'=200 OR 'httpstatus'=201 OR 'httpstatus'=204 OR 'httpstatus'=401 OR 'httpstatus'=403 OR'httpstatus'=404 OR 'httpstatus'=422 OR 'httpstatus'=429,1,0) And in this line are any calls other than those which are 400 being included? eval fourHundredFail=if('httpstatus'=400, 1,0) Full query below: vhost="brand" | eval successfulCall=if('httpstatus'=200 OR 'httpstatus'=201 OR 'httpstatus'=204 OR 'httpstatus'=401 OR 'httpstatus'=403 OR'httpstatus'=404 OR 'httpstatus'=422 OR 'httpstatus'=429,1,0) | eval fourHundredFail=if('httpstatus'=400, 1,0) | eval technicalFail=if(match(substr('httpstatus',1,1),"5") ,1,0) | eval allCalls = successfulCall + fourHundredFail + technicalFail | eval allFailures = fourHundredFail + technicalFail | eval totalSuccesfulCalls = allCalls-allFailures | stats sum(allCalls) as "Total no. calls" sum(successfulCall) as "2xx_or_4xx_Calls" sum(allFailures) as "Total no. failures" sum(fourHundredFail) as "400_Failures" sum(technicalFail) as "5xx_Failures" sum(totalSuccesfulCalls) as "Total_Successful_Calls" by vhost |eval percentageAvailability=(('Total_Successful_Calls'/'Total no. calls')*100) |eval percentageAvailability=round('percentageAvailability', 2) |table vhost, "Total no. calls", "2xx_or_4xx_Calls", "Total no. failures", "400_Failures", "5xx_Failures", percentageAvailability |appendpipe [stats avg(percentageAvailability) as averagePercentage] |eval averagePercentage=round('averagePercentage', 2) |sort by "percentageAvailability" asc Thanks very much for your help, it is much appreciated.
... View more
