In order to to chart your data, sometimes you will need to format results to fit your desired chart needs.
Create a chart that displays error codes by minute, over the last 15 minutes. Transposing your original results will allow you to create a table with time in your rows and status code in your columns.
| parse "HTTP/1.1\" * " as status_code
| timeslice by 1m
| count by _timeslice, status_code
| transpose row _timeslice column status_code
Bonus: Filter out 304 and 200 status codes directly in the query to yield a better formatted chart. If done correctly, your results should look similar to the chart below.