https://community.splunk.com/t5/Splunk-Search/Display-a-timechart-count-as-positive-and-negative-values/m-p/243270#M72416 <P>Can you try this:</P> <PRE><CODE>your query to get you the stats of status and count | eval myCount=if(status!=200, -count, count) | timechart values(myCount) by status </CODE></PRE> Mon, 21 Nov 2016 16:03:14 GMT gokadroid 2016-11-21T16:03:14Z https://community.splunk.com/t5/Splunk-Search/Display-a-timechart-count-as-positive-and-negative-values/m-p/243269#M72415 <P>I've a standard time chart, counting up HTTP error codes. It's all fine, however I'd like to separate out the error-type codes. A good visual way would be to somehow alter them with a negative modifier. </P> <P>For example I have the HTTP OK code as coming up as a total of 200 events on Monday, while I have 10 404 errors. I'd like someway to alter the 10 to -10 so that when it's graphed it's easy to identify the errors - as they all lie below the X axis. I don't need an exact answer, just a nudge in the right direction.</P> Mon, 21 Nov 2016 15:07:31 GMT https://community.splunk.com/t5/Splunk-Search/Display-a-timechart-count-as-positive-and-negative-values/m-p/243269#M72415 markramsay20070 2016-11-21T15:07:31Z https://community.splunk.com/t5/Splunk-Search/Display-a-timechart-count-as-positive-and-negative-values/m-p/243270#M72416 <P>Can you try this:</P> <PRE><CODE>your query to get you the stats of status and count | eval myCount=if(status!=200, -count, count) | timechart values(myCount) by status </CODE></PRE> Mon, 21 Nov 2016 16:03:14 GMT https://community.splunk.com/t5/Splunk-Search/Display-a-timechart-count-as-positive-and-negative-values/m-p/243270#M72416 gokadroid 2016-11-21T16:03:14Z