Below is the query I created to compare response codes for a 24 time period
| parse regex..
| parse regex...
| timeslice by 8h
| if (status_code matches "20*","200s"."others") as status_code_group
| count by _timeslice,status_code_group
| transpose row _timeslice column status_code_group as %"200s",%"Others"
| compare with timeshift 24h
I run it for the Last 24 hours which gives me status code comparison of last 24 hours with the previous 24 hours. When plotted as a Bar chart, each 8h timeslice consists of 4bars (200s,Others,200s_24h,Others_24h)side bye side. However, I would prefer a stacked bar chart where an 8 hour timeslice consists of 2 bars where each bar consists of 200s and Others stacked on top . How can I modify my query to get that view? Please help.
Please sign in to leave a comment.