When searching for status errors, how to remove the most frequent error from results to properly display the others in a visualization?

[skoelpin]

I'm creating dashboards for the error status. We currently have 3 different statuses (200,404, and 0). The '200' status is the most common which accounts for ~13,000 while the Status '404' has a count of 5 and the Status '0' has a count of 2. I'm using a barchart to get a visualization of their frequencies and the 13,000 '404s' makes the other 2 statuses appear as they are zero.. How can I remove the 200 Status so I can just see the '404' and '0' statuses?

I tried using |outlier with no luck.. My current query is below

index=uv Status="| STATUS |* " | top Status

[skoelpin · Accepted solution]

I ended up having to do this statically by using the limit=2 command.

Below is my query

index=uv Status="| STATUS |* |" | rare limit=2 Status

[ppablo]

Have you tried adding Status!=200 to your search?

[skoelpin]

That doesn't work since the Status is enclosed in pipes. Any idea how I could get rid of the most frequent 200 call?

[ppablo]

hmm what does your table of results look like with your current search? Is there a "Status" column displaying values 200, 404 and 0 with their respective counts?