You shall ask these two questions:
Do I want span between two data points of a timechart to adjust automatically?
Am I OK with concatenating the status code and URL as a single field?
If the answer to above two questions is yes then you shall use time chart as follows, where answer to second question is more important as timechart takes snigle by clause whereas span can always be controlled by using span= option within timechart command :
index=XYZ environment=Production clientName="XYZClient" (statusCode!=200 AND statusCode!=-1) earliest=-24h
| eval myfield= url."#".statusCode
| timechart count by myfield
Else you shall use chart command with bucketing _time first and then charting count over _time by url,statusCode , something like below to see if it works out to give the visualization you expect:
index=XYZ environment=Production clientName="XYZClient" (statusCode!=200 AND statusCode!=-1) earliest=-24h
| bucket _time span=1h
| chart count over _time by url,statusCode
... View more