Knowledge Management

How do I add meaningful labels to error codes?

harishnpandey
Explorer

How do I add meaningful labels to error codes?

index=akamai_pi_prod   message.reqHost=*rpama* message.status IN ("200","201","204","206","302","304","403","404","500","502")|rename message.status="200" as "200-Success"| chart count by message.reqHost,message.status

Current Result With above query

message.reqHost 200 206 304 502

xyz.com 12568 23000 100 56

Expected Result:

message.reqHost 200-Succes 206 -Partial Content 304-Cache 502-Bad Gateway

xyz.com 12568 23000 100 56

Appreciate your help on this

Thanks,
Harish

Tags (1)
0 Karma

bcyates
Communicator

Eval is your friend. Try this:

index=akamai_pi_prod message.reqHost=rpama message.status IN ("200","201","204","206","302","304","403","404","500","502") | eval Status=case(message.status == 200, "Success", message.status == 206, "Partial Content", message.status == 304, "Cache", message.status == 502, "Bad Gateway", true(), "Unknown") | stats count by message.reqHost,Status

harishnpandey
Explorer

Current Query :

index=akamai_pi_prod message.reqHost=rpama message.status IN ("200","201","204","206","302","304","403","404","500","502")|chart count by message.reqHost,message.status

0 Karma

Vijeta
Influencer

You can do in Settings->fields->CalculatedFields

0 Karma

harishnpandey
Explorer

No, I dont have access to Splunk configurations so I have to manage with Splunk query only

0 Karma

Vijeta
Influencer

Do the rename for each status code after the chart command-

 chart count by message.reqHost,message.status| rename "200" as "Success_200", 206 as "206-Partial" ....
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...