I am serching a log that has statuses. When I run the search and chart it, I get a bar for each status. There are, say, 10 statuses. Instead, I want to group the data into 2 results: one result is the count of status < 400, and the other is the count of status >= 400. Any idea how I get this?
... | stats c(eval(status<400)) AS low c(eval(status>=400)) AS high
Please note that you need to rename the fields with AS like above.
EDIT: changed so that the exact value of 400 would be counted as 'high'.
Hope this helps,
Thanks Kristian! This worked. I tweaked it a bit because I hadn't put my question clearly, but your syntax worked. Here is what I ended up with:
...| timechart c(eval(status>400)) AS FAILURE c(eval(status<=400)) AS SUCCESS