Categorize range of status values and calculate count

[Viveklearner]

We have range of statua from 200 to 600. Want to search logs and create a output in below sample for range as 200 to 400 as success, 401 to 500 as exception, 501 to 500 as failure:

Sucess - 100

Exceptio - 44

Failure - 3

I am able to get above format data but getting duplicate rows for each category e.g.

Success - 10

Success - 40

Sucess - 50

Exception - 20

Exception - 24

Failure - 1

Failure -2

Query 

Ns=abc app_name= xyz

| stats count by status
| eval status=if(status>=200 and status<400,"Success",status)
| eval status=if(status>=400 and status<500,"Exception",status)
| eval status=if(status>=500,"Failure",status)

Kindly help.

[gcusello · Accepted solution]

Hi @Viveklearner ,

please see my approach and adapt it to your data

<your_search>
| eval Status=case(status>=200 AND status<400,"Success",status>=400 AND status<500,"Exception",status>=500,"Failure",status)
| stats count BY Status

Ciao.

Giuseppe

[Viveklearner]

It worked.. thanks a lot

[gcusello]

Hi @Viveklearner ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉