Hi everyone, I am comparatively new to Splunk and trying to create visualization of each http status code vs all traffic line graph that is traversing though the device. I am able to extract all status code due to a specific path and was able to each of the status code for a specified time as below: index=infra_device_sec sourcetype=device:cloudmonitor:json "message.reqPath"="/test/alpha/beta/delta" | stats count by message.status message.statuscount 0 30 200 3129 302 56321 403 10439 408 25   I am trying to create a graph for each status code vs all traffic as below:  index=infra_device_sec sourcetype=device:cloudmonitor:json "message.reqPath"="/test/alpha/beta/delta" | stats count by message.status | eval x=if('message.status'=503,"ServerDenied","All-Traffic") | timechart span=20m count by x useother=f<   But the output is showing only all traffic on a line graph. Could someone please guide two things: 1- How can create a line graph on each status code vs all traffic 2- How can I create a line graph which include all above status code vs all traffic.    Please let me know if any clarification is needed.    thank you  ... View more