Splunk Search

Grouping (Range?) HTTP Status codes

dbcase
Motivator

Hi,

I have queries that I'd like to group HTTP Status codes together... (i.e. anything 200-299, or 300-399, or 400-499, or 500-599) . I have a dropdown that prompts the user to select

 <input type="dropdown" token="http_code" searchWhenChanged="true">
        <label>Select Http Status Code Range:</label>
        <default>200</default>
        <choice value="200">200 - 299</choice>
        <choice value="300">300 - 399</choice>
        <choice value="400">400 - 499</choice>
        <choice value="500">500 - 599</choice>

      </input>

but I'm not sure how to get the query working. This is what I have it it kinda works but it still returns other codes even thought the value is zero

index=itscom source=*access* |rex "HTTP\S+ (?<status>\d+)"|stats count(eval(searchmatch("status=2*"))) as "200-299" by status

alt text

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Try this

index=itscom source=*access* |rex "HTTP\S+ (?<status>\d+)" 
| bucket status span=100 | eval status=mvindex(split(status,"-"),0)."-".(tonumber(mvindex(split(status,"-"),1))-1)
| stats count by status

View solution in original post

somesoni2
Revered Legend

Try this

index=itscom source=*access* |rex "HTTP\S+ (?<status>\d+)" 
| bucket status span=100 | eval status=mvindex(split(status,"-"),0)."-".(tonumber(mvindex(split(status,"-"),1))-1)
| stats count by status

dbcase
Motivator

Wow, tat is pretty good! It doesn't seem to get the 500-599 ones though.

0 Karma

dbcase
Motivator

nevermind, my fat fingers can't type so well :slightly_smiling_face:

0 Karma

somesoni2
Revered Legend

Lets try this than

index=itscom source=*access* |rex "HTTP\S+ (?\d+)" 
 | bucket status span=100 | eval status=mvindex(split(status,"-"),0)."-".(tonumber(mvindex(split(status,"-"),0))+99)
 | stats count by status
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...