How to display table of total error status code and total success status code by host?

[aa0]

Hi,
I am a newbie in Splunk. I have to write a splunk query to get the status_code count for error(status range 300 and above) and success(status range 200-299) by host.

This is my current search(24 hrs) but unfortunately return 0 result except for host list displayed

index=xxxx  host=*  status=*
| stats count(status>=300) as "Error",
count(status<299) as "OK" by host

Expected result:

Host          |          Error          | OK

----------------------------------------

xxxx           |          23              |  1

[aa0]

Thanks guys, solved! 

[richgalloway]

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

[rrovers]

maybe if you replace "sum" by "count"

[richgalloway · Accepted solution]

To evaluate an expression in stats you must use the eval function within the aggregation function. 

index=xxxx  host=*  status=*
| stats sum(eval(status>=300)) as "Error", sum(eval(status<299)) as "OK" by host

I changed count to sum because the eval function always returns either 0 or 1 so count will only tell you how many evaluations were done.

[aa0]

Thanks for your reply! I've tried the command but it still didn't did the trick, list of hosts is there but the total error and total success are missing somewhere

[richgalloway]

Make sure there are no spaces in the sum clauses.  I've had them fail when I put a space before a "(".