Splunk Search

How to create a graph or table for the following query according to the Status Code ?? Please refer the result below.

JyotiP
Path Finder

{"StatusCode":200,"ReasonPhrase":"OK","Method":"POST","PathAndQuery":"}
{"StatusCode":404,"ReasonPhrase":"Not Found","Method":"GET","PathAndQuery":"}
{"Message":"Completed request to Create Position Events.","}.

For the above I have three categorize like status code 200, 400 and NONE. So I want to create a graph or count on the basis of Status Code. How to do it ??

0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

This will get you a bar graph...

 your base search that gets the records you want with StatusCode and _time
 | fillnull value="None" StatusCode
 | stats count by StatusCode

This will get you a chart over time...

your base search that gets the records you want with StatusCode and _time
| fillnull value="None" StatusCode
| timechart count by StatusCode

View solution in original post

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

This will get you a bar graph...

 your base search that gets the records you want with StatusCode and _time
 | fillnull value="None" StatusCode
 | stats count by StatusCode

This will get you a chart over time...

your base search that gets the records you want with StatusCode and _time
| fillnull value="None" StatusCode
| timechart count by StatusCode

View solution in original post

0 Karma

JyotiP
Path Finder

@DalJeanis, thanks for the update, will try the above two.

niketnilay
Legend

@JyotiP, are these indexed as single event or separate events?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

JyotiP
Path Finder

@niketnilay, these are separate events.

0 Karma

niketnilay
Legend

Please try the following:

<YourBaseSearch>
| rex field=_raw "{\"StatusCode\":(?<StatusCode>[^,]+),"
| stats count by StatusCode

Can you also add example for StatusCode None?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

JyotiP
Path Finder

@niketnilay, thanks for the update, will try the above.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!