How to create a graph or table for the following query according to the Status Code ?? Please refer the result below.

[JyotiP]

{"StatusCode":200,"ReasonPhrase":"OK","Method":"POST","PathAndQuery":"}
{"StatusCode":404,"ReasonPhrase":"Not Found","Method":"GET","PathAndQuery":"}
{"Message":"Completed request to Create Position Events.","}.

For the above I have three categorize like status code 200, 400 and NONE. So I want to create a graph or count on the basis of Status Code. How to do it ??

[DalJeanis · Accepted solution]

This will get you a bar graph...

 your base search that gets the records you want with StatusCode and _time
 | fillnull value="None" StatusCode
 | stats count by StatusCode

This will get you a chart over time...

your base search that gets the records you want with StatusCode and _time
| fillnull value="None" StatusCode
| timechart count by StatusCode

[JyotiP]

@DalJeanis, thanks for the update, will try the above two.

[niketn]

@JyotiP, are these indexed as single event or separate events?

[JyotiP]

@niketnilay, these are separate events.

[niketn]

Please try the following:

<YourBaseSearch>
| rex field=_raw "{\"StatusCode\":(?<StatusCode>[^,]+),"
| stats count by StatusCode

Can you also add example for StatusCode None?

[JyotiP]

@niketnilay, thanks for the update, will try the above.