Splunk Search

command to find count of specific errors

navd
New Member

I want to find number of 500 , 200 , 300 error present in the logs . I have already fields extracted for error_code
so I am doing something like this index="abc" |stats count(eval(error_code=502)) AS error_code which is working but how do I include in query for other error codes ?

Tags (1)
0 Karma
1 Solution

jluo_splunk
Splunk Employee
Splunk Employee

Hi Navd,

There are a couple approaches here. If you like, you could do it defining each error code you care about, and then use stats to count across them. For example..

index=navd sourcetype=test (error_code=200 OR error_code=300 OR error_code=500) 
| stats count by error_code

You could also continue using the method you're currently using, though I think it's a bit verbose. For example..

index=navd sourcetype=test 
| stats count(eval(error_code=200)) as "200_Errors", count(eval(error_code=300)) as "300_Errors", count(eval(error_code=500)) as "500_Errors"

If you'd like all the different errors present, you could aggregate across them all by using this..

index=navd sourcetype=test 
| stats count by error_code

View solution in original post

0 Karma

jluo_splunk
Splunk Employee
Splunk Employee

Hi Navd,

There are a couple approaches here. If you like, you could do it defining each error code you care about, and then use stats to count across them. For example..

index=navd sourcetype=test (error_code=200 OR error_code=300 OR error_code=500) 
| stats count by error_code

You could also continue using the method you're currently using, though I think it's a bit verbose. For example..

index=navd sourcetype=test 
| stats count(eval(error_code=200)) as "200_Errors", count(eval(error_code=300)) as "300_Errors", count(eval(error_code=500)) as "500_Errors"

If you'd like all the different errors present, you could aggregate across them all by using this..

index=navd sourcetype=test 
| stats count by error_code
0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...