Dashboard customization - change 500, 504 to 5xx count

[cmarrott]

500 and 504 are shown here - but i'd like to condense them to one column="5xx" (same with 400, where all 4% responses would be shown under "4xx"

    <panel>
      <table>
        <title>Functions Statistics by ResponseCode</title>
        <search base="base_search3">
          <query>
            stats sum(count) as Count sum(S) as Success sum(F) as Failures avg(Avg_ResponseTime) as Average_ResponseTime by _time FNAME CODE |
            eval Availability=(Success/(Success+Failures))*100 |
            chart count by FNAME CODE
          </query>
        </search>
        <option name="count">15</option>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>

the above is the relevant code

[richgalloway · Accepted solution]

Use eval to normalize the error codes before counting them.

<panel>
      <table>
        <title>Functions Statistics by ResponseCode</title>
        <search base="base_search3">
          <query>
            eval CODE=case(CODE/100=5, "5xx", CODE/100=4, "4xx", CODE/100=2, "2xx", 1==1,CODE)
            | stats sum(count) as Count sum(S) as Success sum(F) as Failures avg(Avg_ResponseTime) as Average_ResponseTime by _time FNAME CODE |
            eval Availability=(Success/(Success+Failures))*100 |
            chart count by FNAME CODE
          </query>
        </search>
        <option name="count">15</option>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>