This worked almost, I just replaced the "if" with a "case" and it worked perfectly. So the final version would be:
index=ex_prod sourcetype=backend (/finish status:200) OR (/registration status:403)
| eval type=case((like(_raw, "%/finish%") AND like(_raw, "%status:200%")), "finish", (like(_raw, "%/registration%") AND like(_raw, "%status:403%")), "registration")
| timechart span=1d count by type
... View more