500 and 504 are shown here - but i'd like to condense them to one column="5xx" (same with 400, where all 4% responses would be shown under "4xx"     <panel> <table> <title>Functions Statistics by ResponseCode</title> <search base="base_search3"> <query> stats sum(count) as Count sum(S) as Success sum(F) as Failures avg(Avg_ResponseTime) as Average_ResponseTime by _time FNAME CODE | eval Availability=(Success/(Success+Failures))*100 | chart count by FNAME CODE </query> </search> <option name="count">15</option> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel>     the above is the relevant code ... View more

    <query>"$ps_fn$" |rex field=message "(?&lt;Http&gt;HttpStatus): (?&lt;status&gt;\\d+)" | eval status=(status, "4%"),"4xx" | stats count by status</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest>     I am trying to make a pie chart that shows all the 4xx errors, and then breaks them out by error - so x% was 401, y% was 402, etc. But i am getting Error in 'eval' command: The expression is malformed. Expected ). when i run this on the dashboard. ... View more