Splunk Search

How to display table of total error status code and total success status code by host?

aa0
Path Finder

Hi,
I am a newbie in Splunk. I have to write a splunk query to get the status_code count for error(status range 300 and above) and success(status range 200-299) by host.

This is my current search(24 hrs) but unfortunately return 0 result except for host list displayed

index=xxxx  host=*  status=*
| stats count(status>=300) as "Error",
count(status<299) as "OK" by host

Expected result:

Host          |          Error          | OK

----------------------------------------

xxxx           |          23              |  1

Labels (4)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

To evaluate an expression in stats you must use the eval function within the aggregation function. 

index=xxxx  host=*  status=*
| stats sum(eval(status>=300)) as "Error", sum(eval(status<299)) as "OK" by host

I changed count to sum because the eval function always returns either 0 or 1 so count will only tell you how many evaluations were done.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

aa0
Path Finder

Thanks guys, solved! 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma

rrovers
Contributor

maybe if you replace "sum" by "count"

richgalloway
SplunkTrust
SplunkTrust

To evaluate an expression in stats you must use the eval function within the aggregation function. 

index=xxxx  host=*  status=*
| stats sum(eval(status>=300)) as "Error", sum(eval(status<299)) as "OK" by host

I changed count to sum because the eval function always returns either 0 or 1 so count will only tell you how many evaluations were done.

---
If this reply helps you, Karma would be appreciated.

aa0
Path Finder

Thanks for your reply! I've tried the command but it still didn't did the trick, list of hosts is there but the total error and total success are missing somewhere

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Make sure there are no spaces in the sum clauses.  I've had them fail when I put a space before a "(".

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...