Splunk Enterprise

How to display response status for particular url of an environment in a table?

vinod_52791
Engager

i have environments like "A" "B" "C" "D", each environments have different clients,Now I want to display response status for particular url of an environment in a table like below

clent="x"

Requested Url             responnseStatus=200       responseStatus=400      responsestatus=500
      
**********                                      45                                            55                                                   10

__________                                 24                                            14                                                     5

 

Client="y" 

 

Requested Url             responnseStatus=200       responseStatus=400      responsestatus=500
      
**********                                      15                                            5                                                   10

__________                                 42                                            24                                                  15

 

Labels (1)
Tags (1)
0 Karma

tscroggins
Influencer

Hi,

With fields named url and status, you can use the chart command to count over url by status:

| chart count over url by status
url200404
/1230
/broken03

 

You can rename fields and modify field values to adjust table column names:

| rename url as "Requested Url"
| eval status="responseStatus=".status
| chart count over "Requested Url" by status
Requested UrlresponseStatus=200responseStatus=404
/1230
/broken03

 

In either case, your base search should include your target events:

index=foo environment=A client=x
| rename url as "Requested Url"
| eval status="responseStatus=".status
| chart count over "Requested Url" by status

 You can improve performance by adding indexed fields like source and sourcetype to your base search, using accelerated data models, etc., but those are topics best left to a new question.

0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...