topic Re: Splunk alert based on HTTP status codes in Security

How create Splunk alert based on HTTP status codes?

Pathik — Fri, 20 Jan 2023 15:53:38 GMT

After searching various posts around HTTP status codes, ended up posting new question 😞

I would like to create alert if failures are 5% of total traffic.

My criteria of failure is anything that doesn't match HTTP status code 200, 400, 401, 403

Thanks in advance

Pathik

Re: Splunk alert based on HTTP status codes

venkatasri — Fri, 30 Jul 2021 06:00:56 GMT

Hi @Pathik Can you try this.

Re: Splunk alert based on HTTP status codes

Pathik — Tue, 03 Aug 2021 16:07:17 GMT

Thanks @venkatasri ,

Its not working, applied what you shared. but getting only bad requests. (success count not coming in output at all it seems)

Any other things to change?

Re: Splunk alert based on HTTP status codes

ITWhisperer — Tue, 03 Aug 2021 16:17:44 GMT

<your search> | eval fail=if(status IN (200,400,401,403),0,1) | stats count as total sum(fail) as fails | eval percent=100*fails/total | where percent>5

Re: Splunk alert based on HTTP status codes

Pathik — Mon, 09 Aug 2021 05:12:23 GMT

Works like a charm @ITWhisperer , thanks a ton

Re: Splunk alert based on HTTP status codes

vinothkumark — Fri, 20 Jan 2023 13:00:59 GMT

Hi, can you help on the query if multiple condition needs to be met in the same query?
Example: status code is 500 and greater than 10% alert should be triggered. also, if status code is 403 and greater than 20% alert should be triggered.