grouping data in search

[joegrossman]

I am serching a log that has statuses. When I run the search and chart it, I get a bar for each status. There are, say, 10 statuses. Instead, I want to group the data into 2 results: one result is the count of status < 400, and the other is the count of status >= 400. Any idea how I get this?

[kristian_kolb]

Like this.

   ... | stats c(eval(status<400)) AS low c(eval(status>=400)) AS high 

Please note that you need to rename the fields with AS like above.

EDIT: changed so that the exact value of 400 would be counted as 'high'.

Hope this helps,

Kristian

[kristian_kolb]

Good to hear. Please mark as answered and/or upvote. Thanks, Kristian

[joegrossman]

Thanks Kristian! This worked. I tweaked it a bit because I hadn't put my question clearly, but your syntax worked. Here is what I ended up with:
...| timechart c(eval(status>400)) AS FAILURE c(eval(status<=400)) AS SUCCESS

[mwhite_splunk]

Can you please paste the search you are currently using to do this?