Hi! First question and relative newbie, so bear with me! :)
I created below query to show the number of missing server ID's per rack. But I can't get the `BY` clause and percentage calculation to work in the same query.
index=servers
| eval serverId_present=if(isnotnull(serverId), "OK", "Missing server ID")
| stats count as totalServers, count(eval(serverId_present="Missing server ID")) as missingServers
| eval missingPercentage=round(100*missingServers/totalServers, 2)
| chart sum(totalServers), sum(missingServers), sum(missingPercentage) by rack
No results found when using the `BY` clause at the end of the chart pipe. But when I remove the `BY` clause, it generates a table with only one row where the missingPercentage is correct.
Resuslts without `BY` clause:
sum(totalServers) sum(missingServers) sum(missingPercentage)
854043 16326 1.91
So I created a second query to see if that worked instead, but no:
index=servers
| eval serverId_present=if(isnotnull(serverId), "OK", "Missing server ID")
| chart count AS totalServers count(eval(serverId_present="Missing server ID")) AS missingServers count(eval(round(100*missingServers/totalServers,2))) AS missingPercentage by rack
This query generates a table with rows for each rack where all the missingPercentage is just "0". Still a "0" if I remove the `BY` clause. The `BY` clause is working though and showing rows for each Instance.
Resuslts with `BY` clause:
Instance totalOrders totalError missingRate
Rack1 575555 2502 0
Rack2 278488 13824 0
Tried `stats` command instead of `chart` but no difference.
↧