How to sum status like 201, 202 error status become 2xx.?

Chaser — Thu, 01 Dec 2022 16:46:23 GMT

I want to get a search for get sum status error of http_user_agent like second dashboard. I do not know how to sum status like 201, 202 error status becom 2xx.

Re: Error Status

yuanliu — Thu, 01 Dec 2022 09:51:39 GMT

@ChaserWhen you ask a question, please illustrate data in text. You can add screenshots if that's helpful, but do not solely rely on screenshot. In this case, I don't see how the first screenshot is useful in explaining your question. It doesn't contain anything related to status error, just a list of http_user_agent values. Is status error already extracted as a separate field?

Assuming that status error is already in a field, say, http_status_error, it is still unclear what you mean by "sum status error". You example about "2xx" makes me speculate that all you want is to count by the first digit of status error and chart over user agent. (Try not to make others read your mind.) If so, try

| eval http_status_error = replace(http_status_error, "\d\d$", "") | chart count over http_user_agent by http_status_error

Hope this helps.

topic How to sum status like 201, 202 error status become 2xx.? in Splunk Search

How to sum status like 201, 202 error status become 2xx.?

Re: Error Status