Hello all,
I have the following search:
index =datapower environment=PROD mpgw(Subscription-Aysnc) 'HTTP response code*'
| rex field=_raw "HTTP response code?(?<responseCode>.{4})"
| stats count by responseCode
| rex field=responseCode mode=sed "s/200/Success/g"
However, the | rex field=responseCode mode=sed "s/200/Success/g"
is not working. I have also tried | replace "200" with "Success"
and nothing... What am I doing wrong?
Thanks!
The problem is that you are capturing 4 any characters
with .{4}
and then you are comparing to 200
which is only 3 characters long. These must match or be otherwise compatible. Try this:
index =datapower environment=PROD mpgw(Subscription-Aysnc) 'HTTP response code*'
| rex field=_raw "HTTP response code\D*(?<responseCode>\d+)"
| stats count BY responseCode
| rex field=responseCode mode=sed "s/200/Success/g"
The problem is that you are capturing 4 any characters
with .{4}
and then you are comparing to 200
which is only 3 characters long. These must match or be otherwise compatible. Try this:
index =datapower environment=PROD mpgw(Subscription-Aysnc) 'HTTP response code*'
| rex field=_raw "HTTP response code\D*(?<responseCode>\d+)"
| stats count BY responseCode
| rex field=responseCode mode=sed "s/200/Success/g"
Instead of doing the rex, use a lookup which would be more in line with what you probably want anyway if you want more than 200's replaced. You will have to install a CSV file of the codes with their long name responseCode, then use your search doing something like:
index =datapower environment=PROD mpgw(Subscription-Aysnc) 'HTTP response code*'
| rex field=_raw "HTTP response code?(?<code>.{4})"
| lookup httpcodes code OUTPUT responseCode
| stats count by responseCode
The format of you CSV should be something like:
code,responseCode,info
100,Continue,Informational
101,Switching Protocols,Informational
200,OK,Successful
201,Created,Successful
202,Accepted,Successful
203,Non-Authoritative Information,Successful
204,No Content,Successful
205,Reset Content,Successful
206,Partial Content,Successful
300,Multiple Choices,Redirection