Splunk Search

how to append query ?

venkat0896
Path Finder

Hi Guys
i have 3 queries

query 1 : identity/phones/retrieve AND "[HTTP-STATUS-CODE]" | stats count as Total
query 2 : identity/phones/retrieve AND "[HTTP-STATUS-CODE]=200" | stats count as 200-Success
query 3 : identity/phones/retrieve AND "[HTTP-STATUS-CODE]=403" | stats count as 403-Forbidden

how can i append this 3 queries and i want this to looks like a table with 3 columns
Total | 200-Success | 403-Forbidden

please help on this .. Thanks in advance

Tags (1)
0 Karma

renjith_nair
Legend

@venkat0896 ,

Try ,

"your base search"|stats count as Total,count(eval(HTTP-STATUS-CODE==200)) as 200-Success,count(eval(HTTP-STATUS-CODE=="403")) as 403-Forbidden
---
What goes around comes around. If it helps, hit it with Karma :slightly_smiling_face:
0 Karma

venkat0896
Path Finder

hi @renjith.nair i tried it
getting this error

Error in 'stats' command: The eval expression for dynamic field 'eval(HTTP-STATUS-CODE=="403")' is invalid. Error='Typechecking failed. The '==' operator received different types.'

0 Karma

renjith_nair
Legend

@venkat0896 , is it possible to share the stats part of your search? Please check if you have used the status codes as string (with ") and numeric (without ") in two places and if yes, change it to single format

---
What goes around comes around. If it helps, hit it with Karma :slightly_smiling_face:
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...