Hi,
I need to take data from field **Source** and calculate this data : **http_400*100/Total+http_500*100/Total+http_300*100/Total**
And show in chart. For now I have this:
`| eval fields=split(_raw,"/")
| eval Source=mvindex(fields,3)
| rex field=_raw "(?ms)(?\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})"
| rangemap field=http_status_code http_200=200-299,http_300=300-399,http_400=400-499,http_500=500-599
| bucket _time span=1h
| chart count over _time by Source `
Please advise!
↧