Dashboards & Visualizations

how to make a new field based on status code

Mohsin123
Path Finder

I've this | eval status=if(CODE=200,"success","failure") 

i need to have 3 fields like success, failure , total

I'm trying this 

| stats eval(if(c(CODE=200))) as success

but its not working 

Could you please help ?

Labels (1)
0 Karma
1 Solution

SanjayReddy
SplunkTrust
SplunkTrust

Hi @Mohsin123 

Can you try this

| stats count(eval(CODE="200")) as "success" count(eval(CODE="<addcodenumber>")) as "failure"  count(CODE) as "total" 


View solution in original post

0 Karma

SanjayReddy
SplunkTrust
SplunkTrust

Hi @Mohsin123 

Can you try this

| stats count(eval(CODE="200")) as "success" count(eval(CODE="<addcodenumber>")) as "failure"  count(CODE) as "total" 


0 Karma
Get Updates on the Splunk Community!

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Combine Multiline Logs into a Single Event with SOCK: a Step-by-Step Guide for ...

Combine multiline logs into a single event with SOCK - a step-by-step guide for newbies Olga Malita The ...