Hi, I am trying to plot the Crash rate over _time on a graph and that has to be distributed by app_name.
On a high level, I want to know the crash rate of different apps over time.
Below is the search I am using but it is not working. It is giving incorrect data for the sub search.
For some timings, the "CrashCount" value is coming higher than "TotalCount" which makes the crash_rate more than 100%.
I am not able to figure out what is wrong in the query.
Any help will be much appreciated.
index=test sourcetype=test:ping app_name="*_App"
| bin _time span=1h
| stats distinct_count(uid) as "TotalCount" by app_name _time
| appendcols
[ search index=test (sourcetype=test:error AND value=false) app_name="*_App"
| bin _time span=1h
| stats distinct_count(uid) as "CrashCount" by app_name _time ]
| eval crash_rate=round(('CrashCount'/'TotalCount')*100,2)
| timechart span=1h max(crash_rate) as crash_rate
uid - is the count of users accessing or crashing the app.
@Shashank_87 Try below-
index=test (sourcetype=test:ping OR (sourcetype=test:error AND value=false) ) app_name="_App"
| bin _time span=1h | dedup uid app_name sourcetype _time
| stats count(eval(sourcetype=test:ping) ) as "TotalCount", count(eval(sourcetype=test:error) ) as "CrashCount" by app_name _time| eval crash_rate=round(('CrashCount'/'TotalCount')*100,2)
| timechart span=1h max(crash_rate) as crash_rate
@Shashank_87 Try below-
index=test (sourcetype=test:ping OR (sourcetype=test:error AND value=false) ) app_name="_App"
| bin _time span=1h | dedup uid app_name sourcetype _time
| stats count(eval(sourcetype=test:ping) ) as "TotalCount", count(eval(sourcetype=test:error) ) as "CrashCount" by app_name _time| eval crash_rate=round(('CrashCount'/'TotalCount')*100,2)
| timechart span=1h max(crash_rate) as crash_rate
Hi Vijeta, that's bang on!
That's what i was needed. Thank you.