topic Re: Multi-variable Bar Graph in Dashboards & Visualizations

Multi-variable Bar Graph

JoshuaJohn — Mon, 05 Jun 2017 19:39:00 GMT

Hi I am trying to make a multi-variable bar graph (Similar to the image below)

The first bar would be a static number: 22500

The second bar would be this search:
| inputlookup Report.csv | search u_last_policyrequest_time=*| fields u_last_policyrequest_time| eval Last_Policy_Request = strptime(u_last_policyrequest_time, "%m/%d/%Y %H:%M") | where Last_Policy_Request > relative_time(now(),"-48h")

I am not sure if it is possible to combine them like this. All of these results come from the same place.

Re: Multi-variable Bar Graph

DalJeanis — Mon, 05 Jun 2017 21:15:09 GMT

Lots of ways to do this, here's one...

| inputlookup Report.csv 
| search u_last_policyrequest_time=*  OR isnotnull(u_wifi_mac_address)
| eval Last_Policy_Request = strptime(u_last_policyrequest_time, "%m/%d/%Y %H:%M") 
| eval policyCount=if(Last_Policy_Request > relative_time(now(),"-48h"),1,0)
| eval macCount=if(isnotnull(u_wifi_mac_address),1,0)
| stats sum(policyCount) as bar2, sum(macCount) as bar3
| eval bar1=22500
| eval bar4=bar1-bar3

Re: Multi-variable Bar Graph

somesoni2 — Mon, 05 Jun 2017 22:11:54 GMT

Another version

| inputlookup Report.csv
| stats count(eval(strptime(u_last_policyrequest_time,"%m/%d/%Y %H:%M")>relative_time(now(),"-48h")))) as Policy_Request_last2days
count(Mac_Address) as SNTotal_Asset_Records
| eval No_Record=22500-SNTotal_Asset_Records
| eval BaseBar=22500
| table BaseBar Policy_Request_last2days SNTotal_Asset_Records No_Record

Re: Multi-variable Bar Graph

DalJeanis — Tue, 06 Jun 2017 00:05:34 GMT

Heh. I need to practice typing | stats count(eval(blahblahblah)) until I have convinced myself that the code will actually run...