Splunk Search

How to create a search to get number of events for HTTP status code?

rajawccm16
Engager

Hi All,

I have the logs below and need to get an HTTP status code count.

10.176.242.7 - app [21/May/2020:16:09:01 +0000] "GET /data/app1/2016-11-04/2582478/0CA087DB-8F72-4E5D-9F9C-F4E0C362601F.pdf.zip HTTP/1.1" 200 95098

10.176.242.7 - app [21/May/2020:16:09:01 +0000] "GET /data/app2/2016-11-04/2582478/0CA087DB-8F72-4E5D-9F9C-F4E0C362601F.pdf.zip HTTP/1.1" 401 95098

10.176.242.7 - app [21/May/2020:16:09:01 +0000] "GET /data/app3/2016-11-04/2582478/0CA087DB-8F72-4E5D-9F9C-F4E0C362601F.pdf.zip HTTP/1.1" 404 95098

Please help me create a Splunk search.

--Raja

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Assuming you don't have fields extracted, try this for starters.

index=foo
| rex "1\.1" (?<status>\d+)"
| stats count by status
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...