Hi,
I'd like to count the number of HTTP 2xx and 4xx status codes in responses, group them into a single category and then display on a chart. The count itself works fine, and I'm able to see the number of counted responses. I'm basically counting the number of responses for each API that is read from a CSV file.
However, I'm struggling with the problem that I'd like to count the number 2xx and 4xx statuses, sum them and group under a common label named: "non5xx" that refers to non-server status codes and display on a chart.
So far, I've come up with the following search query, but it fails to meet my expectations:
[| inputlookup api_names_file.csv | rename AppName to app_name | table app_name ] | chart count(eval(like(status, "2%"))) AS successResponses, count(eval(like(status, "4%"))) AS clientErrorResponses, count(eval(like(status, "5%"))) AS 5xx BY status | eval total = (successResponses + clientErrorResponses) | eventstats sum(total) AS non5xx by status | fields non5xx, 5x
Ideally, I'd like to end up with the following chart:
Is it possible to display such a common label consisting of the sum of two responses on an arbitrary chart e.g. a pie chart?
Thanks in advance
Hi @wjz,
I think it is the same question.
https://answers.splunk.com/answers/591435/counting-the-number-of-responses-and-displaying-in.html
have you tried these searches suggested in above question??
Search for the count of status like 2xx,4xx & 5xx.
| inputlookup api_names_file.csv | eval status=case(like(status, "2%"),"2xx",like(status, "4%"),"4xx",like(status, "5%"),"5xx") | stats count by status
Search for the count of status like non5xx & 5xx.
| inputlookup api_names_file.csv | eval status=case(like(status, "2%") OR like(status, "4%"),"non5xx",like(status, "5%"),"5xx") | stats count by status
Just change the visualization to the pie chart.
Happy Splunking
Hi @wjz,
I think it is the same question.
https://answers.splunk.com/answers/591435/counting-the-number-of-responses-and-displaying-in.html
have you tried these searches suggested in above question??
Search for the count of status like 2xx,4xx & 5xx.
| inputlookup api_names_file.csv | eval status=case(like(status, "2%"),"2xx",like(status, "4%"),"4xx",like(status, "5%"),"5xx") | stats count by status
Search for the count of status like non5xx & 5xx.
| inputlookup api_names_file.csv | eval status=case(like(status, "2%") OR like(status, "4%"),"non5xx",like(status, "5%"),"5xx") | stats count by status
Just change the visualization to the pie chart.
Happy Splunking
Hi,
Yes, I've accidentally posted two questions. Of course, it solved my problems and it works like a charm.
Thank you once again! 🙂