Looking to group your Results into Categories?

Comments

1 comment

  • Avatar
    Mario Sanchez

    This is great, but what if I just want a current snapshot, not a trend over time. Easy peasy!

    _sourceCategory=Labs/Apache/Access
    | if (status_code matches "2*", 1, 0) as success
    | if (status_code matches "3*", 1, 0) as redirects
    | if (status_code matches "4*", 1, 0) as client_error
    | if (status_code matches "5*", 1, 0) as server_error
    | sum(success) as Success, sum(client_error) as client_Error, sum(server_error) as server_Error, sum(redirects) as Redirects

     

    But, if I plan to chart this in a Pie chart, then I better show my results in one same column. In that case, I can follow this example:

    _sourceCategory=Labs/Apache/Access
    | count by status_code
    | if (status_code matches "2*", "success", status_code) as status
    | if (status_code matches "3*", "redirects", status) as status
    | if (status_code matches "4*","client_error" , status) as status
    | if (status_code matches "5*", "server_error", status) as status
    | sum(_count) by status

     

    Enjoy!

    0
    Comment actions Permalink

Please sign in to leave a comment.