Splunk Search

How to chart a daily count of HTTP status codes displayed as different colors based on status values?

dhavamanis
Builder

Can you please help me build this query?

We have a column of status codes and need to get the results in a chart for each day's count with different colors based on the values?

status values like:

200
404
503
302
500

1 Solution

aljohnson_splun
Splunk Employee
Splunk Employee

sourcetype=your_sourcetype earliest=-7d@d | timechart count by status

This search will give the last week's daily status counts in different colors. You'll likely have 200 off the chart so it may be worth making the 200 an overlay. Go to Format > Chart Overlay and select 200, then view it as it's own axis in order to let the other codes actually be seen. I also stacked the values so they're easier to see too.

alt text

View solution in original post

vgaltes
Explorer

Hi, what can I do if I wanted to group all the 400 in the same color?

Thanks,

richgalloway
SplunkTrust
SplunkTrust

This question is over two years old with an accepted answer. If you have a similar problem, please post a new question.

---
If this reply helps you, Karma would be appreciated.
0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

sourcetype=your_sourcetype earliest=-7d@d | timechart count by status

This search will give the last week's daily status counts in different colors. You'll likely have 200 off the chart so it may be worth making the 200 an overlay. Go to Format > Chart Overlay and select 200, then view it as it's own axis in order to let the other codes actually be seen. I also stacked the values so they're easier to see too.

alt text

dhavamanis
Builder

Thank you, i was trying like below, can you please check the below query, how to get the results using bin and span command with chart,

index="nbcutelemundo" | bin span=1s _time | stats count(status) as status_count by _time,status | chart status_count by _time,status span=1d

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

sourcetype=access_combined status=* | bucket _time span=1d | chart count by _time, status

Once again, I overlaid the 200's so that you can actually see the other values.

alt text

0 Karma

dhavamanis
Builder

thank you so much!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...