@ChaserWhen you ask a question, please illustrate data in text. You can add screenshots if that's helpful, but do not solely rely on screenshot. In this case, I don't see how the first screenshot is useful in explaining your question. It doesn't contain anything related to status error, just a list of http_user_agent values. Is status error already extracted as a separate field?
Assuming that status error is already in a field, say, http_status_error, it is still unclear what you mean by "sum status error". You example about "2xx" makes me speculate that all you want is to count by the first digit of status error and chart over user agent. (Try not to make others read your mind.) If so, try
| eval http_status_error = replace(http_status_error, "\d\d$", "")
| chart count over http_user_agent by http_status_error
Hope this helps.
