Alerting on a percentage of events

[tmenagh]

I want to craft an alert that will get the number of errors:

sourcetype="my-thing" error | stats count

and the number of not errors:

sourcetype="my-thing" NOT error | stats count

then get the percentage of the first over the second

[tmenagh · Accepted solution]

I think I got it:

sourcetype="my-thing" | eval err = if(searchmatch("error"), 1, 0) | eval notErr = if(searchmatch("NOT error"), 1, 0) | stats sum(err) as errNo sum(notErr) as notErrNo | eval errorPercentage = errNo/notErrNo*100

[tmenagh]

Good call, Reed!

[reed_kelly]

Looking good. I would have thought you want errNo/count*100. If you have only errors, you will get divide by zero error instead of 100%.