Splunk Search

How to extract HTTP status codes in report?

ruchijain
New Member

Hi,
I know how to extract the HTTP Status from Splunk. But I need it in the below format which I am not able to do:

  1. If any status with 2% and 3% then it will show as "Success"
  2. Apart from that, it will show all the status codes (example 400, 428, 430, 500, 520 or anything )

I am able to extract all the codes:

|eval status=case(like(status,"2%"),"2xx",like(status,"3%"),"3xx",like(status,"4%"),"4xx",like(status,"5%"),"5xx") | stats count by status | eventstats sum(count) as perc | eval perc=round(count*100/perc,2)

But in this, the table is like this:

status  count  perc
2xx  3154   96.63
3xx  44  1.35
4xx  66  2.02

If I remove the eval and like statement then it will show the result as below:

status count perc
200 2922  88.84
201 252   7.66
302 22  0.67
304 25  0.76
401 9    0.27
404 6    0.18
422 53  1.61

Whereas I want the result as below:

Status              count   perc
success(2X and 3X)  300     8.00
401                 9       0.27
404                 6       0.18
422                 53      1.61

Can anyone help me? Thank you.

Tags (2)
0 Karma
1 Solution

jnudell_2
Builder

If you want what you exactly wrote:

... [ you search ] ...
| eval status = if(match(status, "^[23]\d\d"), "success(2X and 3X)", status)
| top status

View solution in original post

0 Karma

jnudell_2
Builder

If you want what you exactly wrote:

... [ you search ] ...
| eval status = if(match(status, "^[23]\d\d"), "success(2X and 3X)", status)
| top status
0 Karma

Vijeta
Influencer

@ruchijain Try below

<your base search>| eval status=if(like(status,"2%") OR like(status,"3%"),"Success",status) | stats count by status| eventstats sum(count) as perc | eval perc=round(count*100/perc,2)
0 Karma

somesoni2
Revered Legend

Try like this

your base search
|eval status=if(like(status,"2%") OR like(status,"3%"),"Success",status) 
| top 0 status

The top command does what you want to do with your stats-eventstats-eval combo.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...