Splunk Search

Group by responseCode


Hi I have the following query that creates a report of the major transactions for a website with their count and average response time. I would like to seperate the count column into number requests that succeeded and requests that failed for each request type, i.e so divide this count column into requests with response code 200 and requests with response code of anything other than 200.

index=vero_anzn_prod approveRiskRequest OR finalizeQuote OR premiumGrid OR approveRiskAccept OR illustration OR archiveRisks OR premiumInstallments OR add OR recalculateRates OR cancelPolicy OR completeScenario OR search OR save OR getPDF NOT (uri=.js OR uri=.png OR uri=.css OR uri=.gif OR uri=.ico OR uri=.jpg)
| rex field=uri_path mode=sed "s/quote\/[0-9]+/quote\/QUOTENO/"
| rex field=uri_path mode=sed "s/referralHistory\/.*\//referralHistory\/REFHSEARCH\//"
| eval Request=uri_path.method
| stats count avg(responseTime) BY Request

I realize I could add responseCode to the BY part of the query but this doesn't give me exactly what I want.



Tags (1)
0 Karma

Splunk Employee
Splunk Employee

replace your stats command with:

... | eval type=if(responseCode=="200","good","bad") | stats count avg(responeTime) by Request,type
0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...