---
layout: post
title:  "Splunk cheat sheet"
teaser: Cheat sheet for splunk queries
date:   2017-03-08 12:39:26 +0000
categories: cheat-sheets
---

# Extract subnet from IP address

```
<search> |  rex field=ip "(?<subnet>\d+\.\d+\.\d+)\.\d+" | stats count by subnet
```

---
layout: post
title:  "Splunk cheat sheet"
teaser: Cheat sheet for splunk queries
date:   2017-03-08 12:39:26 +0000
categories: cheat-sheets
---

# Extract subnet from IP address

```
<search> |  rex field=ip "(?<subnet>\d+\.\d+\.\d+)\.\d+" | stats count by subnet
```

# Calculate availability percentage based on status code
```
index="prod1" sourcetype="mc-gdm:web:access-log" | stats count as total, count(eval(statusCode=200)) as ok | eval uptime=((ok/total)*100) | table uptime
```

Add search query for http status code based uptime calculation
Add search query for http status code based uptime calculation