Splunk Search

How to extract HTTP status codes in report?

New Member

Hi,
I know how to extract the HTTP Status from Splunk. But I need it in the below format which I am not able to do:

  1. If any status with 2% and 3% then it will show as "Success"
  2. Apart from that, it will show all the status codes (example 400, 428, 430, 500, 520 or anything )

I am able to extract all the codes:

|eval status=case(like(status,"2%"),"2xx",like(status,"3%"),"3xx",like(status,"4%"),"4xx",like(status,"5%"),"5xx") | stats count by status | eventstats sum(count) as perc | eval perc=round(count*100/perc,2)

But in this, the table is like this:

status  count  perc
2xx  3154   96.63
3xx  44  1.35
4xx  66  2.02

If I remove the eval and like statement then it will show the result as below:

status count perc
200 2922  88.84
201 252   7.66
302 22  0.67
304 25  0.76
401 9    0.27
404 6    0.18
422 53  1.61

Whereas I want the result as below:

Status              count   perc
success(2X and 3X)  300     8.00
401                 9       0.27
404                 6       0.18
422                 53      1.61

Can anyone help me? Thank you.

Tags (2)
0 Karma
1 Solution

Builder

If you want what you exactly wrote:

... [ you search ] ...
| eval status = if(match(status, "^[23]\d\d"), "success(2X and 3X)", status)
| top status

View solution in original post

0 Karma

Builder

If you want what you exactly wrote:

... [ you search ] ...
| eval status = if(match(status, "^[23]\d\d"), "success(2X and 3X)", status)
| top status

View solution in original post

0 Karma

Influencer

@ruchijain Try below

<your base search>| eval status=if(like(status,"2%") OR like(status,"3%"),"Success",status) | stats count by status| eventstats sum(count) as perc | eval perc=round(count*100/perc,2)
0 Karma

Revered Legend

Try like this

your base search
|eval status=if(like(status,"2%") OR like(status,"3%"),"Success",status) 
| top 0 status

The top command does what you want to do with your stats-eventstats-eval combo.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!