All Apps and Add-ons

basic http status query (404 error 200 success)

nathanluke86
Communicator

I would like to show http traffic from my f5 (load balancer) to web servers for statuses 200 and 404 (200 green, 404 red). As a basic example something like this:

index = iis
| stats sum(eval(status="404")) as error sum(eval(status="200")) as success by dest_ip
|eval from="f5" , to=dest_ip
|head 100
|table from to success error

I can't seem to get the flows working. I have changed names to match error, warn, good but have not had much success.

any pointers would be appreciated.

please feel free to expand on this query to add more value. My aim is to visualize traffic flows to show when there are issues etc

0 Karma
1 Solution

chrisyounger
SplunkTrust
SplunkTrust

Hi @nathanluke86

Thanks for using my Viz. This query should work:

index = iis
| stats count(eval(status="404")) as error count(eval(status="200")) as good by dest_ip
|eval from="f5" , to=dest_ip
|head 100
|table from to good error

View solution in original post

chrisyounger
SplunkTrust
SplunkTrust

Hi @nathanluke86

Thanks for using my Viz. This query should work:

index = iis
| stats count(eval(status="404")) as error count(eval(status="200")) as good by dest_ip
|eval from="f5" , to=dest_ip
|head 100
|table from to good error

nathanluke86
Communicator

Thanks, this worked perfectly

0 Karma

hychen1116
New Member

Hi,
I'd like to show near real time web traffic without refresh dashboard,
any pointers would be appreciated.

0 Karma

nathanluke86
Communicator

Is there also a way to display Success instead of good

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

at the end of your query, add this:

| eval label = "Success: " + good + " Error: " + error
0 Karma
Get Updates on the Splunk Community!

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...