Splunk Search

How to extract the HTTP Status Code?

bryceweb22
Path Finder

I need help with extracting and graphing the HTTP status code which is always the end of every log formatted as;

`200 0 0 140 or 403 0 0 455`

wherein those two examples the 200 and the 403 represent just two types of many different status codes.

0 Karma
1 Solution

hmarkus
Explorer

something like 200 0 0 140 or 403 0 0 455 is the end of every line?

-> add in props.conf in your apache Sourcetype:
EXTRACT-http_statuscode = (?<statuscode>\d+)\s\d+\s\d+\s\d+$

-> If your data is already in Splunk, you can use this in your search to test it:
<your search> | rex field=_raw "(?<statuscode>\d+)\s\d+\s\d+\s\d+$"

-> explanation:
https://regex101.com/r/ct4C7D/1

-> After extracting the field (either in props.conf or in your search) you can use
<your search and extraction> | timechart count by statuscode
or
<your search and extraction> | stats count by statuscode

 -> or use Splunk built in extractions for default access logs
 <your search> | extract access-extractions | stats count by statuscode

View solution in original post

hmarkus
Explorer

something like 200 0 0 140 or 403 0 0 455 is the end of every line?

-> add in props.conf in your apache Sourcetype:
EXTRACT-http_statuscode = (?<statuscode>\d+)\s\d+\s\d+\s\d+$

-> If your data is already in Splunk, you can use this in your search to test it:
<your search> | rex field=_raw "(?<statuscode>\d+)\s\d+\s\d+\s\d+$"

-> explanation:
https://regex101.com/r/ct4C7D/1

-> After extracting the field (either in props.conf or in your search) you can use
<your search and extraction> | timechart count by statuscode
or
<your search and extraction> | stats count by statuscode

 -> or use Splunk built in extractions for default access logs
 <your search> | extract access-extractions | stats count by statuscode

bryceweb22
Path Finder

Thank you that fixed my problem. To answer your question yes something like those examples are at the very end of every log it is formatted in IIS logging.

0 Karma

pruthvikrishnap
Contributor

if there is a prefix it would be very easy, you can do something like this in props.conf "prefix : (?<status_code>\d+)"
else you will have to white list all the expected status codes in props.conf and use them something like this https://answers.splunk.com/answers/319823/how-to-configure-propsconf-and-transformsconf-to-o.html

0 Karma
Get Updates on the Splunk Community!

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...