How do I make a stack column chart with two events organized by services? - splunk

Question

Basically I need to make a column chart with the different endpoints along the x axis (services such as log in, etc.) with each endpoint having a unique column stacked with two colors, red for service error events and green for service events.
I can get something with a search string like this:
my search EVENT="[SERVICES]" OR EVENT="[SERVICE_ERROR]" | chart count by EVENT, ENDPOINT
though its event on the x axis (but showing both services and service error like I need) with the endpoints being different colored stacked in the chart.
Yet reversing this causes ONLY SERVICE EVENTS to show up, which is beyond my reasoning since service errors appear in the first search.
Above is just something I tried. I also tried:
my search | fields ENDPOINT "[SERVICE]" "[SERVICE_ERROR]"
according to the splunk documentation on stacking charts here:
https://docs.splunk.com/Documentation/Splunk/7.1.1/Viz/ColumnBarCharts
(last example at bottom of page).
I wanted to make sure I was thorough with my explanation but in short...
My goal is to have the all the endpoints displayed on the x axis with the count of the different service events and service error events as the actual graph data as one column split into two colors for both events.
Thank you for any help!!

Answer 1

I found the answer and wanted to share in case anyone else might find this helpful:
First, I made a unique field for error using the field extractor. "[SERVICE_ERROR]" wanted to link to all other events similar to it so I had to use "error_message" to extract my errors.
Next I added this to my search string:
....... | stats count(eval(match(EVENT,"[SERVICE]"))) AS service count(error) AS error BY endservice
This calculates a table that finds the count of both the event "[SERVICE]" and the field "error" and renames them using "AS/as". The field "endservice" is a field extraction I use to get more accurate endpoints.
Finally I go to my chart's format option (near the magnifying glass and three dots in the upper right hand corner, it looks like a paint brush) and click on it. After that I selected "stacked column" (the middle one).
The voila! I have my stacked graph of two different data types! I hope this helps someone else someday.