Creating A Graph from summed HTML responses

[ctallarico20]

Hi, I have a log with entries returning something such as

[2013-05-29 12:29:08:893 GBT] RESULTS 200=19 400=0 401=12 404=0 503=0

And I'm looking for a way to make a stacked bar/column graph, summing the number of responses. In this case, there are 19 responses of '200' and 12 responses of '401'. I looked at something along the lines of "200" OR "401" | timechart sum(200) as Successes sum(401) as Failures but that graph won't display any information.

Thanks for the help!

EDIT:

I'd like to add that I manually changed the logs to 'res200=19', 'res401=12', etc and then ... | sum(res200) sum(res401). By adding in the 'res-' prefix, spunk no longer was trying to real an integer, and it worked flawlessly. Is there a way I can tell splunk to just look for the value after 200, like it does with res200?

[ctallarico20 · Accepted solution]

Nevermind everybody, I found my own solution. I used a rex field - RESULTS | rex field=_raw "200=(?<r200>.*) 400=(?<r400>.*) 401=(?<r401>.*) 404=(?<r404>.*) 503=(?<r503>.*)" | timechart sum(r200) sum(r400) sum(r401) sum(r404) sum(r503)