replace your stats command with: ... | eval type=if(responseCode=="200","good","bad") | stats count avg(responeTime) by Request,type ... View more

In the new versions of splunk you can use the chart overlay setting ... View more

Hi. Thanks for the responses. This is no longer a problem as the indexing was changed so that the uri_path is an extracted field so I can group by this rather than the full url with all the dynamic values. There are still some dynamic values in the uri_path but not that many so my queries aren't too long. ... View more

Thanks jonuwz for the quick response. That works perfectly. Cheers. ... View more