Monitoring Splunk

Treat certain response codes as OK, in "Website Monitoring" app?


(New to Splunk - please forgive rookie questions.)

The question is about Website Monitoring app's configuration.

It's somewhat similar to How to replace the response code value in a dashboard panel, however in my case I'd treat certain response codes (401, 503) as "OK" - not an error - for specific URLs. Possible?


Tags (1)
0 Karma


quite a late response but i tried the below query which prints the response code in OK you need to edit for other response code

sourcetype="web_ping" website_monitoring_search_index| stats avg(total_time) as avg_response_time max(total_time) as max_response_time latest(response_code) as response_code latest(_time) as last_checked latest(title) as title latest(url) as url latest(total_time) as response_time range(total_time) as range min(total_time) as min by source|eval FinalStatus = if(response_code == 200, "OK", "Error")|table title FinalStatus last_checked | timesince(last_checked,last_checked)

0 Karma

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!