As additional info to @ITWhisperer comments about time, see this post for info on how time can be set in collected data. It's not as written in the documentation, which is buggy https://community.splunk.com/t5/Getting-Data-In/How-to-log-results-to-an-index/m-p/653651#M110866   ... View more

Ah, ok. I see. I missed that part. Unfamiliar with eventstats. Thank you very much. That worked!! ... View more

Not a problem. It looks like I may have achieved it by modifying your solution. I had issues in the past with Regex so was hoping to use this. I am not sure what "null" does in the below "status_index" but it seems to work by not including frivolous information.   | eval temp=split(_raw," ") | eval status_index1 = if(match(API,"/services/protected/v1/developers"), 6, null) | eval status_index2 = if(match(API,"/services/public/v1/signup"), 6, null) | eval status_index3 = if(match(API,"/wcaapi/userReg/wgt/apps"), 10, null) | eval http_status1 = mvindex(temp, status_index1) | eval http_status2 = mvindex(temp, status_index2) | eval http_status3 = mvindex(temp, status_index3) | eval http_status = coalesce(http_status1, http_status2, http_status3) | search ( "/services/public/v1/signup" OR "/services/protected/v1/developers" OR "/services/public/v1/captcha" OR "/wcaapi/userReg/wgt/apps" ) | search NOT "Mozilla" | eval API = if(match(API,"/services/public/v1/signup"), "DEVP1: Signup", API) | eval API = if(match(API,"/services/protected/v1/developers"), "DEVP1: Developers", API) | eval API = if(match(API,"/services/public/v1/captcha"), "DEVP1: Captcha", API) | eval API = if(match(API,"/wcaapi/userReg/wgt/apps"), "User Registration Enhanced Login", API) | fields API, http_status, wf_env | convert timeformat="%Y-%m" ctime(_time) AS Date | stats count(http_status) as Total_Calls, count(eval(http_status>=500)) as Server_Error by Date, API, wf_env | eval SuccessRate=round((1-(Server_Error/Total_Calls)) * 100,2)   ... View more

Awesome! Excellent insights!! This solution worked out great. I will take a look at failures as well. Thank you very much for this!! ... View more

That definitely works for the time being. Thank you very much! ... View more

Apologies! You are correct. I had a typo. This works perfectly! Thank you very much yuanliu!! ... View more

Actually, I figured it out. Thank you very much!! ... View more

thank you! ... View more

Yes, it is. That worked perfectly. Thank you! ... View more