Splunk Search

In accesslog, "status" search.. help me ^^

khyoung7410
Communicator

Hi


Please help me a little "Search Command".


In accesslog, I should need two results.(count)


I Have a field name "status".


Using status field under line.


--- result ----


* | 404 | 40x 50x | ~


      6         300 ===> count

Please help me.

Thanks

Tags (1)
0 Karma

khyoung7410
Communicator

Hi Ayn!

Thank you for answer.

I learned so much thanks.

0 Karma

Ayn
Legend

Awesome. Could you please mark my answer as accepted? Thanks!

0 Karma

Ayn
Legend

I'm GUESSING the question is how you can get a table containing a count of the different values for the field "status"?

... | stats count by status

Or is the issue how to have one count for "404", but then group together all other 40x status codes? In that case use eval:

.... | eval status_group=case(status="404","404",match(status,"^40"),"40x",match(status,"^50"),"50x") | stats count by status_group
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...