Monitoring and Creating Alerts in Splunk - Splunk Essentials - page 168

Checking the IP status
You might wish to test and see how successful your website traffic is. This can be done by
looking at status codes. Successful status can be defined in various ways, but here it is
defined as being coded from greater or equal to 200 to less than 300. You can use the fol-
lowing code:
* earliest=-2d latest=-1d status>=200 status<300 | timechart
count BY status
The code indicates to include all events from 2 days ago to 1 day ago that have a status
greater than 200 and less than 300, and create a chart showing hours by status. The
timechart defaults to hours, given the setting of one day's time.
The table produced looks like the following screenshot:
Timechart of Counts of Status of Events in the Last Day, Ranging from >= 200 to <300
You can easily turn this into a column chart by clicking the Visualizations tab and select-
ing Column . Likewise, you could turn it into many other types of charts. If you use a
column chart and don't need a legend (since there is only one color bar), you can get rid of
the legend by selecting Format , Legend , None :