|
I'm parsing web logs for the HTTP codes (200, 404, 500, etc). I have the search done which shows the number of each code in a specific time period. I'd like to generate a graph over time (say per hour), with the number of each code found as a separate data set. The search I'm using now is sourcetype="iis*" | rex field=_raw "(?\d+) \d+ \d+$" | stats count by httpcode Is this possible? |
One Answer:
