Super! Thanks! ... View more

Thank you very match fro helping me! This works now fine! Have nice day! ... View more

Gratie Giuseppe! See you next time! Have a nice day. ... View more

Resolved. It works now correctly. I added 'by ...' and I see all the results. Thank you very match!!! ... View more

Thanks! This works partially very good. It provides in the results all calls, success, errors and no_responses (for the calls where no_response happens) . However it ignores other calls where requests and responses are equal. ... View more

index="xxxx" sourcetype="xxxxx" message.request_path!=*/healthCheck           | fillnull value=0 backend_time           | stats count(eval('message.direction'="request")) as Calls, count(eval('message.response_code'="200")) as Success, count(eval('message.response_code'!="200")) as Error E.g. On the resuts, I see:  Calls 27; Success 11; Error 6 I need also to see in the results, that there was no responses for 10 calls (null_resposes) as well.    ... View more

This gives almost the same result, time of succses events. This is useful for the future. For now I wait with this query, because it seems we need a field 'Duration' in message to check the performances of response call ... View more

At this moment, all message responses come in less that 10 seconds. This okay. We want to create an alert, that  if eg, next happens: Time                                                                   message repose code 15:00:43                                                                              200 15:00:45                                                                              200 15:00:54                                                                              200 or Time                                                                   message repose code 15:00:43                                                                              200 15:00:55                                                                              200 15:00:56                                                                              200 So if 3 responses code 200 come with no error response between, and totally, they take more than 10 seconds. ... View more

Thanks! This query gives some answer.  However, I still have to find the one with this situation: I have another alert for non-200 response codes. For this one I want to see if three consecutive 200 responses, take more than 10 seconds totally. That means I will create an alert about this. So the query should result only this three consecutive 200 responses that together take more that 10 seconds. ... View more

I have another alert for non-200 response codes. For this one I want to see if three consecutive 200 responses, take more than 10 seconds totally. That means I will create an alert about this. ... View more

I mean three consecutive respaces 2000. ... View more