Splunk Search

How to sum status like 201, 202 error status become 2xx.?


I want to get a search for get sum status error of http_user_agent like second dashboard. I do not know how to sum status like 201, 202 error status becom 2xx. WhatsApp Image 2022-12-01 at 15.45.40.jpgWhatsApp Image 2022-12-01 at 15.45.09.jpg

Labels (2)
0 Karma


@ChaserWhen you ask a question, please illustrate data in text. You can add screenshots if that's helpful, but do not solely rely on screenshot. In this case, I don't see how the first screenshot is useful in explaining your question. It doesn't contain anything related to status error, just a list of http_user_agent values. Is status error already extracted as a separate field?

Assuming that status error is already in a field, say, http_status_error, it is still unclear what you mean by "sum status error". You example about "2xx" makes me speculate that all you want is to count by the first digit of status error and chart over user agent. (Try not to make others read your mind.) If so, try

| eval http_status_error = replace(http_status_error, "\d\d$", "")
| chart count over http_user_agent by http_status_error

Hope this helps.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...