I don't think this gives you what you want, but it's a couple steps away:
... | bin _time span=1d | stats sum(success) as success sum(failure) as failure by _time,field1
or
... | timechart span=1d sum(success) as s sum(failure) as f by field1
This gives you the data you want, but I think that unfortunately the default Splunk charting capabilities don't let you display the data in the way you want. Specifically, the timechart will only really graph 3 dimensions well (time, count of success/failure, and series/field1) and you really want it to show 4 dimensions (time, count, series/field1, success/failure). More simply, it won't let you create more than one stack per time interval, and you want two of them.
Now, you can do some dirty trick to try to fake this by coding success/failure inside of time, e.g.:
... | bucket _time span=1d | stats sum(success) as s sum(failure) as f by _time,field1 | eval v=mvappend(s,f) | mvexpand v | eval _time=if(v=s,_time,relative_time(_time,"+12h") | timechart span=12h sum(v) as v by field1
which would kind of look right, but the data would be screwy.
... View more
