<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: how to Create column chart against time . in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/how-to-Create-column-chart-against-time/m-p/327777#M21246</link>
    <description>&lt;P&gt;its not working&lt;/P&gt;</description>
    <pubDate>Tue, 12 Dec 2017 11:16:32 GMT</pubDate>
    <dc:creator>vin02</dc:creator>
    <dc:date>2017-12-12T11:16:32Z</dc:date>
    <item>
      <title>how to Create column chart against time .</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/how-to-Create-column-chart-against-time/m-p/327774#M21243</link>
      <description>&lt;P&gt;i have 3 field (a,b,c) and i have calculated resuld d = ((a+b+c)*30)/100&lt;BR /&gt;
I want to represent the output in column chart against time. Graph is like &lt;BR /&gt;
monday 20%&lt;BR /&gt;
tuseday 30 %&lt;BR /&gt;
webnesday 50%&lt;/P&gt;

&lt;P&gt;Could you please suggest query for the same. &lt;/P&gt;</description>
      <pubDate>Tue, 05 Dec 2017 11:31:13 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/how-to-Create-column-chart-against-time/m-p/327774#M21243</guid>
      <dc:creator>vin02</dc:creator>
      <dc:date>2017-12-05T11:31:13Z</dc:date>
    </item>
    <item>
      <title>Re: how to Create column chart against time .</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/how-to-Create-column-chart-against-time/m-p/327775#M21244</link>
      <description>&lt;P&gt;Vin02, I think that you are asking for a chart of value "d" by weekday.&lt;BR /&gt;
Try this:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;base search |bin _time as date span=1d| eval x="pct"  | xyseries date x d | eval date=strftime(date,"%a")
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Tue, 05 Dec 2017 23:41:46 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/how-to-Create-column-chart-against-time/m-p/327775#M21244</guid>
      <dc:creator>MonkeyK</dc:creator>
      <dc:date>2017-12-05T23:41:46Z</dc:date>
    </item>
    <item>
      <title>Re: how to Create column chart against time .</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/how-to-Create-column-chart-against-time/m-p/327776#M21245</link>
      <description>&lt;P&gt;did my answer below do what you needed?&lt;/P&gt;</description>
      <pubDate>Mon, 11 Dec 2017 15:30:22 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/how-to-Create-column-chart-against-time/m-p/327776#M21245</guid>
      <dc:creator>MonkeyK</dc:creator>
      <dc:date>2017-12-11T15:30:22Z</dc:date>
    </item>
    <item>
      <title>Re: how to Create column chart against time .</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/how-to-Create-column-chart-against-time/m-p/327777#M21246</link>
      <description>&lt;P&gt;its not working&lt;/P&gt;</description>
      <pubDate>Tue, 12 Dec 2017 11:16:32 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/how-to-Create-column-chart-against-time/m-p/327777#M21246</guid>
      <dc:creator>vin02</dc:creator>
      <dc:date>2017-12-12T11:16:32Z</dc:date>
    </item>
    <item>
      <title>Re: how to Create column chart against time .</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/how-to-Create-column-chart-against-time/m-p/327778#M21247</link>
      <description>&lt;P&gt;must be frustrating.  What do you have so far, and what are you seeing?  I have verified the end part of my query if I assume that the value for "d" has already been calculated.  I am not able to share a picture, but the query results in a chart like this:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;date    pct
Sun 9
Mon 22
Tue 20
Wed 20
Thu 20
Fri 17
Sat 12
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;(admittedly, pct is  not really percent in my case though) which visualizes into a bar chart by weekday &lt;/P&gt;</description>
      <pubDate>Tue, 12 Dec 2017 14:31:55 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/how-to-Create-column-chart-against-time/m-p/327778#M21247</guid>
      <dc:creator>MonkeyK</dc:creator>
      <dc:date>2017-12-12T14:31:55Z</dc:date>
    </item>
  </channel>
</rss>

