| transpose 0 header_field=NETYPE | fields - column ... View more

Hi @poddura, le me understand: do you want to execute your search only for one Error_Code (FTCODE)? if yes, you can add a static eval at the end  index=xyz sourcetype=app_team log_message.FT=some_ft |rename log_message.CODE as FTCODE | stats count as Total_Requests ,count(eval(FTCODE=="8945")) as Errors by server_host, log_message.FT | eval Error_rate=round(Errors/Total_Requests*100,2).+"%", FTCODE="8945" | rename log_message.FT as FT Yoiu can use the same method also if the error code is passed to the search by an input object. Ciao. Giuseppe   ... View more

You probably need to combine REQID & FT into a single field with a suitable delimiter before you join with the stats command getting values for the combined field instead of REQID & FT, then use mvexpand on the combined field to get your separate rows, then split the combined field back into REQID & FT. ... View more

Okay, first, if you're looking at 30m increments, you are probably not looking for a real time search. How fast will the person have to respond? What is the actual SLA? if they don't have to respond to an alert within 5m, then you want a scheduled search. Second, is your 30 minute window a rolling window, or a fixed window? It's expensive to go back and do things a second or third time. Just get the data all at the same time. What I would tend to do for what you talked about is this - your search that gets the events for the last 90 minutes | rename COMMENT as "divide up the three time periods" | addinfo | eval timeframe= ceiling((_time - info_min_time)/1800) | rename COMMENT as "set up all the fields you need to stats the three periods" | command = (whatever the command was) | errorMessage = coalesce( whatever the error message was, "(NONE)") | stats count as totalCount by command errorMessage timeframe Now you have records for each combination of time period, command and error message, with "(NONE)" for records with no errors. | rename COMMENT as "find total of records for each command for each timeframe " | eventstats sum(totalcount) as commandcount by command timeframe | rename COMMENT as "set the _time to the end of the three time periods" | eval _time=_info_min_time + 1800*timeframe Now you can look at the absolute number and/or percentage of errors in each timeframe that are not "(NONE)" and see whether you have a consistent error condition. One way would be to do this. | eval errorpercent= totalCount /commandcount | eventstats min(errorpercent) as minpercent max(errorpercent) as maxpercent by command | where ... minpercent and maxpercent match some criterial you set. ... View more