Dashboards & Visualizations

Dashboard customization - change 500, 504 to 5xx count

cmarrott
Explorer

cmarrott_0-1625077195726.png

500 and 504 are shown here - but i'd like to condense them to one column="5xx" (same with 400, where all 4% responses would be shown under "4xx"

 

 

    <panel>
      <table>
        <title>Functions Statistics by ResponseCode</title>
        <search base="base_search3">
          <query>
            stats sum(count) as Count sum(S) as Success sum(F) as Failures avg(Avg_ResponseTime) as Average_ResponseTime by _time FNAME CODE |
            eval Availability=(Success/(Success+Failures))*100 |
            chart count by FNAME CODE
          </query>
        </search>
        <option name="count">15</option>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>

 

 

the above is the relevant code



Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Use eval to normalize the error codes before counting them.

<panel>
      <table>
        <title>Functions Statistics by ResponseCode</title>
        <search base="base_search3">
          <query>
            eval CODE=case(CODE/100=5, "5xx", CODE/100=4, "4xx", CODE/100=2, "2xx", 1==1,CODE)
            | stats sum(count) as Count sum(S) as Success sum(F) as Failures avg(Avg_ResponseTime) as Average_ResponseTime by _time FNAME CODE |
            eval Availability=(Success/(Success+Failures))*100 |
            chart count by FNAME CODE
          </query>
        </search>
        <option name="count">15</option>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Use eval to normalize the error codes before counting them.

<panel>
      <table>
        <title>Functions Statistics by ResponseCode</title>
        <search base="base_search3">
          <query>
            eval CODE=case(CODE/100=5, "5xx", CODE/100=4, "4xx", CODE/100=2, "2xx", 1==1,CODE)
            | stats sum(count) as Count sum(S) as Success sum(F) as Failures avg(Avg_ResponseTime) as Average_ResponseTime by _time FNAME CODE |
            eval Availability=(Success/(Success+Failures))*100 |
            chart count by FNAME CODE
          </query>
        </search>
        <option name="count">15</option>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...