Splunk Search

How to sum status like 201, 202 error status become 2xx.?

Chaser
Explorer

I want to get a search for get sum status error of http_user_agent like second dashboard. I do not know how to sum status like 201, 202 error status becom 2xx. WhatsApp Image 2022-12-01 at 15.45.40.jpgWhatsApp Image 2022-12-01 at 15.45.09.jpg

Labels (2)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

@ChaserWhen you ask a question, please illustrate data in text. You can add screenshots if that's helpful, but do not solely rely on screenshot. In this case, I don't see how the first screenshot is useful in explaining your question. It doesn't contain anything related to status error, just a list of http_user_agent values. Is status error already extracted as a separate field?

Assuming that status error is already in a field, say, http_status_error, it is still unclear what you mean by "sum status error". You example about "2xx" makes me speculate that all you want is to count by the first digit of status error and chart over user agent. (Try not to make others read your mind.) If so, try

| eval http_status_error = replace(http_status_error, "\d\d$", "")
| chart count over http_user_agent by http_status_error

Hope this helps.

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...