Knowledge Management

How do I add meaningful labels to error codes?

harishnpandey
Explorer

How do I add meaningful labels to error codes?

index=akamai_pi_prod   message.reqHost=*rpama* message.status IN ("200","201","204","206","302","304","403","404","500","502")|rename message.status="200" as "200-Success"| chart count by message.reqHost,message.status

Current Result With above query

message.reqHost 200 206 304 502

xyz.com 12568 23000 100 56

Expected Result:

message.reqHost 200-Succes 206 -Partial Content 304-Cache 502-Bad Gateway

xyz.com 12568 23000 100 56

Appreciate your help on this

Thanks,
Harish

Tags (1)
0 Karma

bcyates
Communicator

Eval is your friend. Try this:

index=akamai_pi_prod message.reqHost=rpama message.status IN ("200","201","204","206","302","304","403","404","500","502") | eval Status=case(message.status == 200, "Success", message.status == 206, "Partial Content", message.status == 304, "Cache", message.status == 502, "Bad Gateway", true(), "Unknown") | stats count by message.reqHost,Status

harishnpandey
Explorer

Current Query :

index=akamai_pi_prod message.reqHost=rpama message.status IN ("200","201","204","206","302","304","403","404","500","502")|chart count by message.reqHost,message.status

0 Karma

Vijeta
Influencer

You can do in Settings->fields->CalculatedFields

0 Karma

harishnpandey
Explorer

No, I dont have access to Splunk configurations so I have to manage with Splunk query only

0 Karma

Vijeta
Influencer

Do the rename for each status code after the chart command-

 chart count by message.reqHost,message.status| rename "200" as "Success_200", 206 as "206-Partial" ....
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...