I have events that have http error codes in them. I would like to be able to get a percentage of 500 errors for all the events. I have this as my base search:
index=firehose sourcetype="cf_logs_syslog" source_type=RTR
| eval 5xx_code=if(responseCode>=500 AND responseCode<=599, 1, 0)
| eval 4xx_code=if(responseCode>=400 AND responseCode<=499, 1, 0)
| eval 2xx_code=if(responseCode>=200 AND responseCode<=399, 1, 0)
If i were in core splunk I could conjure up the SPL to do this, but I struggle with iTSI as a base search. I would ultimately like to have percentages of all 200-399, 400-499, and 500-599 error codes. I guess you could say that the fact that I cannot use the eval function is killing me 🙂
Any thoughts?
