I'm parsing web logs for the HTTP codes (200, 404, 500, etc). I have the search done which shows the number of each code in a specific time period.
I'd like to generate a graph over time (say per hour), with the number of each code found as a separate data set.
The search I'm using now is
sourcetype="iis*" | rex field=_raw "(?\d+) \d+ \d+$" | stats count by httpcode
Is this possible?
sourcetype="iis*" | rex field=_raw "(?\d+) \d+ \d+$" | timechart span=1h count by httpcode