Here's a template that might come in handy: Use the following query template to track events over time, for example, to identify trends in your status codes, or error types. Edit the query for your _sourceCategory and parse accordingly:
| parse "GET * HTTP/1.1\" * * \"*\"" as url,status_code,size,referrer
| timeslice 1m
| count by status_code, _timeslice
| sort by _timeslice, status_code asc
| transpose row _timeslice column status_code
Please sign in to leave a comment.