topic Re: How to group status code in coloumn in Splunk Search

How to group status code in coloumn

chiddarthan17 — Thu, 05 Dec 2024 00:17:01 GMT

I need to display list of all failed status code in column by consumers

Final Result:

Consumers	Errors	Total_Requests	Error_Percentage	list_of_Status
Test	10	100	10	500 400 404

Is there a way we can display the failed status codes as well in of list of status coloumn

index=test | stats count(eval(status>399)) as Errors,count as Total_Requests by consumers | eval Error_Percentage=((Errors/Total_Requests)*100)

Re: How to group status code in coloumn

richgalloway — Wed, 04 Dec 2024 20:55:29 GMT

Try this query

index=test | stats count(eval(status>399)) as Errors,count as Total_Requests, values(Status) as list_of_Status by consumers | eval Error_Percentage=((Errors/Total_Requests)*100)

Re: How to group status code in coloumn

chiddarthan17 — Wed, 04 Dec 2024 23:12:23 GMT

Thanks a lot. This works fine. Is there a way we can display only status which are greater than 399. Like (status>399)

i tried values(eval(status>399)) but it didn't work.

Re: How to group status code in coloumn

chiddarthan17 — Wed, 04 Dec 2024 23:26:20 GMT

Thanks a lot. This works fine. Is there a way we can display only status which are greater than 399. Like (status>399)

i tried values(eval(status>399)) but it didn't work.

Re: How to group status code in coloumn

bowesmana — Thu, 05 Dec 2024 00:46:14 GMT

You need the eval like this

values(eval(if(status>399, status, null()))) as list_of_Status

otherwise the eval just returns a boolean type result, so you need to use if and assign the result.

You can also do it like this after the stats using mvmap

| eval list_of_Status=mvfilter(list_of_Status>=399)

Re: How to group status code in coloumn

chiddarthan17 — Thu, 05 Dec 2024 01:03:38 GMT

Thank you.This works perfectly.