Totaling success and error web page response codes

We can further amend the search to show only the addItem and checkout web pages events, which seem a little more relevant to sales intelligence. Additionally, using the addcoltotals command, we can add up the total success and error events:

index=main sourcetype=access_combined uri_path="/addItem" OR uri_path="/checkout" | chart count(eval(like(status,"2%"))) AS Success, count(eval(like(status,"4%") OR like(status,"5%"))) AS Error by uri_path | addcoltotals label=Total labelfield=uri_path

When this updated search is run, you should see results similar to the following screenshot:

We use labelfield=uri_path and label=Total to tell Splunk to place a value of Total in the uri_path field column.