I came up with this:
sourcetype="access_common" status=* | top status limit="1000" | appendpipe [ | stats sum(eval(if(match(status,"^[23]"),percent,0))) as percent | eval status="good"] |appendpipe [ | stats sum(eval(if(match(status,"^[45]"),percent,0))) as percent | eval status="bad"]
... View more