https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-to-get-number-of-events-for-HTTP-status/m-p/501942#M139720 <P>Assuming you don't have fields extracted, try this for starters.</P> <PRE><CODE>index=foo | rex "1\.1" (?&lt;status&gt;\d+)" | stats count by status </CODE></PRE> Thu, 21 May 2020 17:33:53 GMT richgalloway 2020-05-21T17:33:53Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-to-get-number-of-events-for-HTTP-status/m-p/501941#M139719 <P>Hi All,</P> <P>I have the logs below and need to get an HTTP status code count.</P> <PRE><CODE>10.176.242.7 - app [21/May/2020:16:09:01 +0000] "GET /data/app1/2016-11-04/2582478/0CA087DB-8F72-4E5D-9F9C-F4E0C362601F.pdf.zip HTTP/1.1" 200 95098 10.176.242.7 - app [21/May/2020:16:09:01 +0000] "GET /data/app2/2016-11-04/2582478/0CA087DB-8F72-4E5D-9F9C-F4E0C362601F.pdf.zip HTTP/1.1" 401 95098 10.176.242.7 - app [21/May/2020:16:09:01 +0000] "GET /data/app3/2016-11-04/2582478/0CA087DB-8F72-4E5D-9F9C-F4E0C362601F.pdf.zip HTTP/1.1" 404 95098 </CODE></PRE> <P>Please help me create a Splunk search.</P> <P>--Raja</P> Thu, 21 May 2020 16:12:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-to-get-number-of-events-for-HTTP-status/m-p/501941#M139719 rajawccm16 2020-05-21T16:12:11Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-to-get-number-of-events-for-HTTP-status/m-p/501942#M139720 <P>Assuming you don't have fields extracted, try this for starters.</P> <PRE><CODE>index=foo | rex "1\.1" (?&lt;status&gt;\d+)" | stats count by status </CODE></PRE> Thu, 21 May 2020 17:33:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-to-get-number-of-events-for-HTTP-status/m-p/501942#M139720 richgalloway 2020-05-21T17:33:53Z