How to do it...

Follow these steps to chart web page response codes over time:

1. Log in to your Splunk server.
2. Select the Search & Reporting application.
3. Ensure that the time range picker is set to Last 24 hours and type the following search into the Splunk search bar. Then, click on Search or hit Enter:

index=main sourcetype=access_combined | chart  count(eval(like(status,"2%"))) AS Success, 
 count(eval(like(status,"4%") OR like(status,"5%"))) AS Error by uri_path

1. Splunk will return a tabulated list of web pages, detailing for each page how many events were successful and how many generated errors, as shown in the following screenshot:
   
2. Click on the Visualization tab and you will see this data represented in a column (by default) chart.
3. Save this search by clicking on Save As and then on Report. Give the report a name of cp02_webpage_response_codes and click on Save. On the next screen, click on Continue Editing to return to the search.