How to extract the HTTP Status Code?

[bryceweb22]

I need help with extracting and graphing the HTTP status code which is always the end of every log formatted as;

`200 0 0 140 or 403 0 0 455`

wherein those two examples the 200 and the 403 represent just two types of many different status codes.

[hmarkus · Accepted solution]

something like 200 0 0 140 or 403 0 0 455 is the end of every line?

-> add in props.conf in your apache Sourcetype:
EXTRACT-http_statuscode = (?<statuscode>\d+)\s\d+\s\d+\s\d+$

-> If your data is already in Splunk, you can use this in your search to test it:
<your search> | rex field=_raw "(?<statuscode>\d+)\s\d+\s\d+\s\d+$"

-> explanation:
https://regex101.com/r/ct4C7D/1

-> After extracting the field (either in props.conf or in your search) you can use
<your search and extraction> | timechart count by statuscode
or
<your search and extraction> | stats count by statuscode

 -> or use Splunk built in extractions for default access logs
 <your search> | extract access-extractions | stats count by statuscode

[bryceweb22]

Thank you that fixed my problem. To answer your question yes something like those examples are at the very end of every log it is formatted in IIS logging.

[pruthvikrishnap]

if there is a prefix it would be very easy, you can do something like this in props.conf "prefix : (?<status_code>\d+)"
else you will have to white list all the expected status codes in props.conf and use them something like this https://answers.splunk.com/answers/319823/how-to-configure-propsconf-and-transformsconf-to-o.html