I have perhaps a better solution for those who seek to get a percent success broken down by some other field over time.
This gives percent success over time by a field "url" in some http logs. Just configure the span in the bucket command to control the time split, and add "%H:%M:%S" to the time format if you need hours/minutes/seconds.
index=my_http sourcetype=http_logs http_status_code IN (2*, 3*, 5*)
| bucket _time span=1d
| eval success=case(match(http_status_code ,"2.*"), "1", match(http_status_code ,"3.*"), "1", match(http_status_code ,"5.*"), "0")
| eventstats count as total, sum(success) as successes by url, _time
| eval pct=round((successes/total)*100,2)
| eval timestring=strftime(_time, "%m-%d-%y")
| chart first(pct) by url, timestring
... View more