Splunk Search

How to display table of total error status code and total success status code by host?

aa0
Path Finder

Hi,
I am a newbie in Splunk. I have to write a splunk query to get the status_code count for error(status range 300 and above) and success(status range 200-299) by host.

This is my current search(24 hrs) but unfortunately return 0 result except for host list displayed

index=xxxx  host=*  status=*
| stats count(status>=300) as "Error",
count(status<299) as "OK" by host

Expected result:

Host          |          Error          | OK

----------------------------------------

xxxx           |          23              |  1

Labels (4)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

To evaluate an expression in stats you must use the eval function within the aggregation function. 

index=xxxx  host=*  status=*
| stats sum(eval(status>=300)) as "Error", sum(eval(status<299)) as "OK" by host

I changed count to sum because the eval function always returns either 0 or 1 so count will only tell you how many evaluations were done.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

aa0
Path Finder

Thanks guys, solved! 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma

rrovers
Communicator

maybe if you replace "sum" by "count"

richgalloway
SplunkTrust
SplunkTrust

To evaluate an expression in stats you must use the eval function within the aggregation function. 

index=xxxx  host=*  status=*
| stats sum(eval(status>=300)) as "Error", sum(eval(status<299)) as "OK" by host

I changed count to sum because the eval function always returns either 0 or 1 so count will only tell you how many evaluations were done.

---
If this reply helps you, Karma would be appreciated.

aa0
Path Finder

Thanks for your reply! I've tried the command but it still didn't did the trick, list of hosts is there but the total error and total success are missing somewhere

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Make sure there are no spaces in the sum clauses.  I've had them fail when I put a space before a "(".

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...