SPL
Percentage of skipped searches
Description
This query will give you a table with a percentage of skipped searches and an evaluation with 3 ranges
2 0
index=_internal sourcetype=scheduler | stats count as total, count(eval(status="skipped")) as skipped | eval pct=round(skipped/total * 100, 0) | rangemap field=pct low=0-10, elevated=10-20 severe=20-100 | eval pct = pct . "%" | fields pct, range
Comments
0 total
Be the first to comment on this SPL.
Leave a comment
You must log in to post a comment.