Newbie question - creating events vs time

[kam_emea]

Hi

New to Splunk and learning how to create a simple dashboard. What I'd like to see is status=403 or status=200 over time

So i've created this search here:

index=main sourcetype="access_combined_wcookie" status=403 OR status=200 | timechart span=1h count 

Then I hit visualise.

Question is, how do I differentiate between 403 and 200, they seem to be amalgamated. Is there a way to colour code them differently?

[ITWhisperer]

index=main sourcetype="access_combined_wcookie" status=403 OR status=200 | timechart span=1h count by status