Knowledge Management

How do I add meaningful labels to error codes?

harishnpandey
Explorer

How do I add meaningful labels to error codes?

index=akamai_pi_prod   message.reqHost=*rpama* message.status IN ("200","201","204","206","302","304","403","404","500","502")|rename message.status="200" as "200-Success"| chart count by message.reqHost,message.status

Current Result With above query

message.reqHost 200 206 304 502

xyz.com 12568 23000 100 56

Expected Result:

message.reqHost 200-Succes 206 -Partial Content 304-Cache 502-Bad Gateway

xyz.com 12568 23000 100 56

Appreciate your help on this

Thanks,
Harish

Tags (1)
0 Karma

bcyates
Communicator

Eval is your friend. Try this:

index=akamai_pi_prod message.reqHost=rpama message.status IN ("200","201","204","206","302","304","403","404","500","502") | eval Status=case(message.status == 200, "Success", message.status == 206, "Partial Content", message.status == 304, "Cache", message.status == 502, "Bad Gateway", true(), "Unknown") | stats count by message.reqHost,Status

harishnpandey
Explorer

Current Query :

index=akamai_pi_prod message.reqHost=rpama message.status IN ("200","201","204","206","302","304","403","404","500","502")|chart count by message.reqHost,message.status

0 Karma

Vijeta
Influencer

You can do in Settings->fields->CalculatedFields

0 Karma

harishnpandey
Explorer

No, I dont have access to Splunk configurations so I have to manage with Splunk query only

0 Karma

Vijeta
Influencer

Do the rename for each status code after the chart command-

 chart count by message.reqHost,message.status| rename "200" as "Success_200", 206 as "206-Partial" ....
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...