Getting Data In

how to consolidate 200/500 error counts in access.log?

anasar
New Member

I have access.log data in index access_index. How can I draw a graph counting 200's and 500's. If I draw for last 1 hour, 2 line graph showing the counts.

index="access_index" response=200 OR response=500.

But after that, I'm lost.

Tags (1)
0 Karma
1 Solution

jluo_splunk
Splunk Employee
Splunk Employee

Hi Anasar,

You can use the timechart command if you'd like to see the data plotted against time.

index="access_index" response=200 OR response=500 | timechart count by response

View solution in original post

yannK
Splunk Employee
Splunk Employee

try this in a visualization panel

index="access_index" response=200 OR response=500 | timechart count by response

If you want to actually count all the 2** and 5** status, not just the 200 and 500.
you can use an eval condition to extract a new field

index="access_index" response=2* OR response=5*  |  eval consolidated_response=case(response>=200 AND response<300,"200 range",response>=500 AND response<600,"500 range",1=1,"other" | search NOT consolidated_response="other" | timechart count by consolidated_response

jluo_splunk
Splunk Employee
Splunk Employee

Hi Anasar,

You can use the timechart command if you'd like to see the data plotted against time.

index="access_index" response=200 OR response=500 | timechart count by response
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...