Splunk Search

Creating A Graph from summed HTML responses

ctallarico20
Path Finder

Hi, I have a log with entries returning something such as

[2013-05-29 12:29:08:893 GBT] RESULTS 200=19 400=0 401=12 404=0 503=0

And I'm looking for a way to make a stacked bar/column graph, summing the number of responses. In this case, there are 19 responses of '200' and 12 responses of '401'. I looked at something along the lines of "200" OR "401" | timechart sum(200) as Successes sum(401) as Failures but that graph won't display any information.

Thanks for the help!

EDIT:

I'd like to add that I manually changed the logs to 'res200=19', 'res401=12', etc and then ... | sum(res200) sum(res401). By adding in the 'res-' prefix, spunk no longer was trying to real an integer, and it worked flawlessly. Is there a way I can tell splunk to just look for the value after 200, like it does with res200?

Tags (2)
0 Karma
1 Solution

ctallarico20
Path Finder

Nevermind everybody, I found my own solution. I used a rex field - RESULTS | rex field=_raw "200=(?<r200>.*) 400=(?<r400>.*) 401=(?<r401>.*) 404=(?<r404>.*) 503=(?<r503>.*)" | timechart sum(r200) sum(r400) sum(r401) sum(r404) sum(r503)

View solution in original post

0 Karma

ctallarico20
Path Finder

Nevermind everybody, I found my own solution. I used a rex field - RESULTS | rex field=_raw "200=(?<r200>.*) 400=(?<r400>.*) 401=(?<r401>.*) 404=(?<r404>.*) 503=(?<r503>.*)" | timechart sum(r200) sum(r400) sum(r401) sum(r404) sum(r503)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...