Hello, I have the following query. <base query> | rex field=msg "HTTP/1.1\\\" (?<http_status>\d{3})"
| where http_status=200 OR http_status=401
| eval event_date=strftime(_time, "%x")
| chart count over event_date by http_status
| eval "401 percentage" = round('401'*100/('200'+'401'),2)."%" that gives me the following table event_date 200 401 401 percentage
========== === === ==============
11/28/21 61 24 28.24%
11/29/21 295 96 24.55% However, when I go to Visualization, I don't see "401 percentage" on the line chart, but I see the "401 percentage" legend. Any idea why and how to get "401 percentage" to show up on the chart? Also, currently, the column header for http_status is the value 200 & 401. How do I change the column headers to "HTTP 200" & "HTTP 401"? Thank you. I'd greatly appreciate the help!
... View more