Splunk Search

How to extract HTTP status codes in report?

ruchijain
New Member

Hi,
I know how to extract the HTTP Status from Splunk. But I need it in the below format which I am not able to do:

  1. If any status with 2% and 3% then it will show as "Success"
  2. Apart from that, it will show all the status codes (example 400, 428, 430, 500, 520 or anything )

I am able to extract all the codes:

|eval status=case(like(status,"2%"),"2xx",like(status,"3%"),"3xx",like(status,"4%"),"4xx",like(status,"5%"),"5xx") | stats count by status | eventstats sum(count) as perc | eval perc=round(count*100/perc,2)

But in this, the table is like this:

status  count  perc
2xx  3154   96.63
3xx  44  1.35
4xx  66  2.02

If I remove the eval and like statement then it will show the result as below:

status count perc
200 2922  88.84
201 252   7.66
302 22  0.67
304 25  0.76
401 9    0.27
404 6    0.18
422 53  1.61

Whereas I want the result as below:

Status              count   perc
success(2X and 3X)  300     8.00
401                 9       0.27
404                 6       0.18
422                 53      1.61

Can anyone help me? Thank you.

Tags (2)
0 Karma
1 Solution

jnudell_2
Builder

If you want what you exactly wrote:

... [ you search ] ...
| eval status = if(match(status, "^[23]\d\d"), "success(2X and 3X)", status)
| top status

View solution in original post

0 Karma

jnudell_2
Builder

If you want what you exactly wrote:

... [ you search ] ...
| eval status = if(match(status, "^[23]\d\d"), "success(2X and 3X)", status)
| top status
0 Karma

Vijeta
Influencer

@ruchijain Try below

<your base search>| eval status=if(like(status,"2%") OR like(status,"3%"),"Success",status) | stats count by status| eventstats sum(count) as perc | eval perc=round(count*100/perc,2)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try like this

your base search
|eval status=if(like(status,"2%") OR like(status,"3%"),"Success",status) 
| top 0 status

The top command does what you want to do with your stats-eventstats-eval combo.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...