Splunk Search

How to extract the HTTP Status Code?

bryceweb22
Path Finder

I need help with extracting and graphing the HTTP status code which is always the end of every log formatted as;

`200 0 0 140 or 403 0 0 455`

wherein those two examples the 200 and the 403 represent just two types of many different status codes.

0 Karma
1 Solution

hmarkus
Explorer

something like 200 0 0 140 or 403 0 0 455 is the end of every line?

-> add in props.conf in your apache Sourcetype:
EXTRACT-http_statuscode = (?<statuscode>\d+)\s\d+\s\d+\s\d+$

-> If your data is already in Splunk, you can use this in your search to test it:
<your search> | rex field=_raw "(?<statuscode>\d+)\s\d+\s\d+\s\d+$"

-> explanation:
https://regex101.com/r/ct4C7D/1

-> After extracting the field (either in props.conf or in your search) you can use
<your search and extraction> | timechart count by statuscode
or
<your search and extraction> | stats count by statuscode

 -> or use Splunk built in extractions for default access logs
 <your search> | extract access-extractions | stats count by statuscode

View solution in original post

hmarkus
Explorer

something like 200 0 0 140 or 403 0 0 455 is the end of every line?

-> add in props.conf in your apache Sourcetype:
EXTRACT-http_statuscode = (?<statuscode>\d+)\s\d+\s\d+\s\d+$

-> If your data is already in Splunk, you can use this in your search to test it:
<your search> | rex field=_raw "(?<statuscode>\d+)\s\d+\s\d+\s\d+$"

-> explanation:
https://regex101.com/r/ct4C7D/1

-> After extracting the field (either in props.conf or in your search) you can use
<your search and extraction> | timechart count by statuscode
or
<your search and extraction> | stats count by statuscode

 -> or use Splunk built in extractions for default access logs
 <your search> | extract access-extractions | stats count by statuscode

bryceweb22
Path Finder

Thank you that fixed my problem. To answer your question yes something like those examples are at the very end of every log it is formatted in IIS logging.

0 Karma

pruthvikrishnap
Contributor

if there is a prefix it would be very easy, you can do something like this in props.conf "prefix : (?<status_code>\d+)"
else you will have to white list all the expected status codes in props.conf and use them something like this https://answers.splunk.com/answers/319823/how-to-configure-propsconf-and-transformsconf-to-o.html

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...