Monitoring Splunk

Treat certain response codes as OK, in "Website Monitoring" app?


(New to Splunk - please forgive rookie questions.)

The question is about Website Monitoring app's configuration.

It's somewhat similar to How to replace the response code value in a dashboard panel, however in my case I'd treat certain response codes (401, 503) as "OK" - not an error - for specific URLs. Possible?


Tags (1)
0 Karma


quite a late response but i tried the below query which prints the response code in OK you need to edit for other response code

sourcetype="web_ping" website_monitoring_search_index| stats avg(total_time) as avg_response_time max(total_time) as max_response_time latest(response_code) as response_code latest(_time) as last_checked latest(title) as title latest(url) as url latest(total_time) as response_time range(total_time) as range min(total_time) as min by source|eval FinalStatus = if(response_code == 200, "OK", "Error")|table title FinalStatus last_checked | timesince(last_checked,last_checked)

0 Karma

0 Karma
Get Updates on the Splunk Community!

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...