Timeline creation using eval case function

[Denorsmith]

I am trying to make a timeline showing different response code ranges being defined. This is the eval I am using, and I want to add the 4 different categories into a timeline dashboard panel.

index="stuff" sourcetype="things" src_ip="1.1.1.1" dest_ip="2.2.2.2"
| search TERM(attack_vector)
| eval Status = case(response_code>="400" OR response_code="0", "Blocked", response_code>="202" AND response_code<="226", "Partial", response_code>="300" AND response_code<="399", "Redirect", response_code="200" OR response_code="201", "Success")

I cannot for the life of me figure out what I need to put in the "stats" and "table" portion to make it show a line for each of the created categories! 

[scelikok · Accepted solution]

Hi @Denorsmith ,

Please try below; (I also

index="stuff" sourcetype="things" src_ip="1.1.1.1" dest_ip="2.2.2.2" TERM(attack_vector)
| eval Status = case(response_code>="400" OR response_code="0", "Blocked", response_code>="202" AND response_code<="226", "Partial", response_code>="300" AND response_code<="399", "Redirect", response_code="200" OR response_code="201", "Success")
| timechart count by Status

removed search term before TERM for faster results)