Getting Data In

how to consolidate 200/500 error counts in access.log?

anasar
New Member

I have access.log data in index access_index. How can I draw a graph counting 200's and 500's. If I draw for last 1 hour, 2 line graph showing the counts.

index="access_index" response=200 OR response=500.

But after that, I'm lost.

Tags (1)
0 Karma
1 Solution

jluo_splunk
Splunk Employee
Splunk Employee

Hi Anasar,

You can use the timechart command if you'd like to see the data plotted against time.

index="access_index" response=200 OR response=500 | timechart count by response

View solution in original post

yannK
Splunk Employee
Splunk Employee

try this in a visualization panel

index="access_index" response=200 OR response=500 | timechart count by response

If you want to actually count all the 2** and 5** status, not just the 200 and 500.
you can use an eval condition to extract a new field

index="access_index" response=2* OR response=5*  |  eval consolidated_response=case(response>=200 AND response<300,"200 range",response>=500 AND response<600,"500 range",1=1,"other" | search NOT consolidated_response="other" | timechart count by consolidated_response

jluo_splunk
Splunk Employee
Splunk Employee

Hi Anasar,

You can use the timechart command if you'd like to see the data plotted against time.

index="access_index" response=200 OR response=500 | timechart count by response
Get Updates on the Splunk Community!

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...