Splunk Search

How to create a graph or table for the following query according to the Status Code ?? Please refer the result below.

Path Finder

{"StatusCode":200,"ReasonPhrase":"OK","Method":"POST","PathAndQuery":"}
{"StatusCode":404,"ReasonPhrase":"Not Found","Method":"GET","PathAndQuery":"}
{"Message":"Completed request to Create Position Events.","}.

For the above I have three categorize like status code 200, 400 and NONE. So I want to create a graph or count on the basis of Status Code. How to do it ??

0 Karma
1 Solution

SplunkTrust
SplunkTrust

This will get you a bar graph...

 your base search that gets the records you want with StatusCode and _time
 | fillnull value="None" StatusCode
 | stats count by StatusCode

This will get you a chart over time...

your base search that gets the records you want with StatusCode and _time
| fillnull value="None" StatusCode
| timechart count by StatusCode

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

This will get you a bar graph...

 your base search that gets the records you want with StatusCode and _time
 | fillnull value="None" StatusCode
 | stats count by StatusCode

This will get you a chart over time...

your base search that gets the records you want with StatusCode and _time
| fillnull value="None" StatusCode
| timechart count by StatusCode

View solution in original post

0 Karma

Path Finder

@DalJeanis, thanks for the update, will try the above two.

SplunkTrust
SplunkTrust

@JyotiP, are these indexed as single event or separate events?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Path Finder

@niketnilay, these are separate events.

0 Karma

SplunkTrust
SplunkTrust

Please try the following:

<YourBaseSearch>
| rex field=_raw "{\"StatusCode\":(?<StatusCode>[^,]+),"
| stats count by StatusCode

Can you also add example for StatusCode None?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Path Finder

@niketnilay, thanks for the update, will try the above.

0 Karma