https://community.splunk.com/t5/Knowledge-Management/How-do-I-add-meaningful-labels-to-error-codes/m-p/416653#M5794 <P><STRONG>Current Query :</STRONG></P> <P>index=akamai_pi_prod message.reqHost=rpama message.status IN ("200","201","204","206","302","304","403","404","500","502")|chart count by message.reqHost,message.status</P> Tue, 29 Sep 2020 21:33:25 GMT harishnpandey 2020-09-29T21:33:25Z https://community.splunk.com/t5/Knowledge-Management/How-do-I-add-meaningful-labels-to-error-codes/m-p/416652#M5793 <P>How do I add meaningful labels to error codes?</P> <PRE><CODE>index=akamai_pi_prod message.reqHost=*rpama* message.status IN ("200","201","204","206","302","304","403","404","500","502")|rename message.status="200" as "200-Success"| chart count by message.reqHost,message.status </CODE></PRE> <H1>Current Result With above query </H1> <P>message.reqHost 200 206 304 502</P> <H1>xyz.com 12568 23000 100 56</H1> <H1>Expected Result:</H1> <P><STRONG>message.reqHost 200-Succes 206 -Partial Content 304-Cache 502-Bad Gateway</STRONG></P> <H1> xyz.com 12568 23000 100 56</H1> <P>Appreciate your help on this </P> <P>Thanks,<BR /> Harish</P> Fri, 12 Oct 2018 17:32:53 GMT https://community.splunk.com/t5/Knowledge-Management/How-do-I-add-meaningful-labels-to-error-codes/m-p/416652#M5793 harishnpandey 2018-10-12T17:32:53Z https://community.splunk.com/t5/Knowledge-Management/How-do-I-add-meaningful-labels-to-error-codes/m-p/416653#M5794 <P><STRONG>Current Query :</STRONG></P> <P>index=akamai_pi_prod message.reqHost=rpama message.status IN ("200","201","204","206","302","304","403","404","500","502")|chart count by message.reqHost,message.status</P> Tue, 29 Sep 2020 21:33:25 GMT https://community.splunk.com/t5/Knowledge-Management/How-do-I-add-meaningful-labels-to-error-codes/m-p/416653#M5794 harishnpandey 2020-09-29T21:33:25Z https://community.splunk.com/t5/Knowledge-Management/How-do-I-add-meaningful-labels-to-error-codes/m-p/416654#M5795 <P>You can do in Settings-&gt;fields-&gt;CalculatedFields</P> Fri, 12 Oct 2018 18:39:24 GMT https://community.splunk.com/t5/Knowledge-Management/How-do-I-add-meaningful-labels-to-error-codes/m-p/416654#M5795 Vijeta 2018-10-12T18:39:24Z https://community.splunk.com/t5/Knowledge-Management/How-do-I-add-meaningful-labels-to-error-codes/m-p/416655#M5796 <P>No, I dont have access to Splunk configurations so I have to manage with Splunk query only</P> Fri, 12 Oct 2018 20:02:01 GMT https://community.splunk.com/t5/Knowledge-Management/How-do-I-add-meaningful-labels-to-error-codes/m-p/416655#M5796 harishnpandey 2018-10-12T20:02:01Z https://community.splunk.com/t5/Knowledge-Management/How-do-I-add-meaningful-labels-to-error-codes/m-p/416656#M5797 <P>Do the rename for each status code after the chart command-</P> <PRE><CODE> chart count by message.reqHost,message.status| rename "200" as "Success_200", 206 as "206-Partial" .... </CODE></PRE> Fri, 12 Oct 2018 20:41:17 GMT https://community.splunk.com/t5/Knowledge-Management/How-do-I-add-meaningful-labels-to-error-codes/m-p/416656#M5797 Vijeta 2018-10-12T20:41:17Z https://community.splunk.com/t5/Knowledge-Management/How-do-I-add-meaningful-labels-to-error-codes/m-p/416657#M5798 <P>Eval is your friend. Try this:</P> <PRE><CODE>index=akamai_pi_prod message.reqHost=rpama message.status IN ("200","201","204","206","302","304","403","404","500","502") | eval Status=case(message.status == 200, "Success", message.status == 206, "Partial Content", message.status == 304, "Cache", message.status == 502, "Bad Gateway", true(), "Unknown") | stats count by message.reqHost,Status </CODE></PRE> Fri, 12 Oct 2018 20:54:54 GMT https://community.splunk.com/t5/Knowledge-Management/How-do-I-add-meaningful-labels-to-error-codes/m-p/416657#M5798 bcyates 2018-10-12T20:54:54Z