topic Re: How to display table of total error status code and total success status code by host? in Splunk Search

How to display table of total error status code and total success status code by host?

aa0 — Thu, 09 Jun 2022 15:49:22 GMT

Hi,
I am a newbie in Splunk. I have to write a splunk query to get the status_code count for error(status range 300 and above) and success(status range 200-299) by host.

This is my current search(24 hrs) but unfortunately return 0 result except for host list displayed

index=xxxx host=* status=*
| stats count(status>=300) as "Error",
count(status<299) as "OK" by host

Expected result:

Host | Error | OK

----------------------------------------

xxxx | 23 | 1

Re: How to display table of total error status code and total success status code by host?

richgalloway — Thu, 09 Jun 2022 18:45:22 GMT

To evaluate an expression in stats you must use the eval function within the aggregation function.

index=xxxx host=* status=* | stats sum(eval(status>=300)) as "Error", sum(eval(status<299)) as "OK" by host

I changed count to sum because the eval function always returns either 0 or 1 so count will only tell you how many evaluations were done.

Re: How to display table of total error status code and total success status code by host?

aa0 — Fri, 10 Jun 2022 08:18:45 GMT

Thanks for your reply! I've tried the command but it still didn't did the trick, list of hosts is there but the total error and total success are missing somewhere

Re: How to display table of total error status code and total success status code by host?

rrovers — Fri, 10 Jun 2022 09:27:16 GMT

maybe if you replace "sum" by "count"

Re: How to display table of total error status code and total success status code by host?

richgalloway — Fri, 10 Jun 2022 12:26:45 GMT

Make sure there are no spaces in the sum clauses. I've had them fail when I put a space before a "(".

Re: How to display table of total error status code and total success status code by host?

aa0 — Fri, 10 Jun 2022 16:18:25 GMT

Thanks guys, solved!

Re: How to display table of total error status code and total success status code by host?

richgalloway — Fri, 10 Jun 2022 17:02:28 GMT

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.