Splunk Operational Intelligence Cookbook - Third Edition

How to do it...

Follow these steps to use a gauge visualization to display the number of web access errors:

1. Log in to your Splunk server.
2. Select the default Search & Reporting application.
3. Ensure that the time range picker is set to Last 24 hours, and type the following search into the Splunk search bar. Then, click on Search or hit Enter:

index=main sourcetype=access_combined status>=400 |  stats count

4. Splunk will return the total count of events where the status code represents an error (400 and 500 status codes).
5. Click on the Visualization tab.
6. As there are a number of visualizations within Splunk, the single value visualization might not be displayed by default within the Visualization tab. Click on the dropdown that lists the visualization ...