Treat certain response codes as OK, in "Website Monitoring" app?

[alexeig]

(New to Splunk - please forgive rookie questions.)

The question is about Website Monitoring app's configuration.

It's somewhat similar to How to replace the response code value in a dashboard panel, however in my case I'd treat certain response codes (401, 503) as "OK" - not an error - for specific URLs. Possible?

Thanks!

[venky1544]

quite a late response but i tried the below query which prints the response code in OK you need to edit for other response code

sourcetype="web_ping" website_monitoring_search_index| stats avg(total_time) as avg_response_time max(total_time) as max_response_time latest(response_code) as response_code latest(_time) as last_checked latest(title) as title latest(url) as url latest(total_time) as response_time range(total_time) as range min(total_time) as min by source|eval FinalStatus = if(response_code == 200, "OK", "Error")|table title FinalStatus last_checked | timesince(last_checked,last_checked)

[sbattista09]

you can do this with eval commands;
https://docs.splunk.com/Documentation/Splunk/7.2.5/SearchReference/Eval

https://docs.splunk.com/Documentation/Splunk/7.2.5/Search/Usetheevalcommandandfunctions

you can do a ton with eval, i would start there.