Hi
New to Splunk and learning how to create a simple dashboard. What I'd like to see is status=403 or status=200 over time
So i've created this search here:
index=main sourcetype="access_combined_wcookie" status=403 OR status=200 | timechart span=1h count
Then I hit visualise.
Question is, how do I differentiate between 403 and 200, they seem to be amalgamated. Is there a way to colour code them differently?
