something like 200 0 0 140 or 403 0 0 455 is the end of every line? -> add in props.conf in your apache Sourcetype: EXTRACT-http_statuscode = (?<statuscode>\d+)\s\d+\s\d+\s\d+$ -> If your data is already in Splunk, you can use this in your search to test it: <your search> | rex field=_raw "(?<statuscode>\d+)\s\d+\s\d+\s\d+$" -> explanation: https://regex101.com/r/ct4C7D/1 -> After extracting the field (either in props.conf or in your search) you can use <your search and extraction> | timechart count by statuscode or <your search and extraction> | stats count by statuscode -> or use Splunk built in extractions for default access logs <your search> | extract access-extractions | stats count by statuscode ... View more