I would like to show http traffic from my f5 (load balancer) to web servers for statuses 200 and 404 (200 green, 404 red). As a basic example something like this:
index = iis
| stats sum(eval(status="404")) as error sum(eval(status="200")) as success by dest_ip
|eval from="f5" , to=dest_ip
|head 100
|table from to success error
I can't seem to get the flows working. I have changed names to match error, warn, good but have not had much success.
any pointers would be appreciated.
please feel free to expand on this query to add more value. My aim is to visualize traffic flows to show when there are issues etc
↧