topic How can I display data in a bar graph for 3 weeks? in Dashboards & Visualizations

How can I display data in a bar graph for 3 weeks?

udaypulipaka — Tue, 12 Feb 2019 16:01:51 GMT

Hi,

I need to display data person wise for 3 weeks in a bar chart. Please find the attached required dashboard image for a better understanding.

My Query is:

index="os" sourcetype="Service"  CaseNumber=* status=*  assignment=* |dedup _time,CaseNumber,assignment |streamstats current=f last(assignment) as lg, last(active) as  Active by CaseNumber|lookup L1Team.csv SS as assigned_to OUTPUT TeamName| eval is_escalated= if(assignment!=lg AND assignment_group="Susta",1,NULL) |eval is_resolved=if(assignment="Susta" AND status="Complete" AND (isnull(Active) OR Active="true"),1,NULL) | stats count(is_escalated) AS "Escalated Cases" count(is_resolved) AS "Resolved Cases" by assigned_to,TeamName| fields - TeamName

How do you make a dashboard in that way?

Re: How can I display data in a bar graph for 3 weeks?

Vijeta — Tue, 12 Feb 2019 17:05:32 GMT

Try this

index="os" sourcetype="Service" CaseNumber= status= assignment=* |dedup _time,CaseNumber,assignment |streamstats current=f last(assignment) as lg, last(active) as Active by CaseNumber|lookup L1Team.csv SS as assigned_to OUTPUT TeamName| eval is_escalated= if(assignment!=lg AND assignment_group="Susta",1,NULL) |eval is_resolved=if(assignment="Susta" AND status="Complete" AND (isnull(Active) OR Active="true"),1,NULL) | bin span=1w _time|stats count(is_escalated) AS "Escalated Cases" count(is_resolved) AS "Resolved Cases" by assigned_to,TeamName,_time| fields - TeamName

Re: How can I display data in a bar graph for 3 weeks?

udaypulipaka — Tue, 12 Feb 2019 18:07:57 GMT

But it will display for 1 weak data right. I want to display data for 3 weaks like I send in image.i want dashboard should display like that in image.how can create that dashboard like that

Re: How can I display data in a bar graph for 3 weeks?

Vijeta — Tue, 12 Feb 2019 18:14:41 GMT

you need to use your earliest time as -3w and latest time as now,it will give you each weeks data for that time span.

Re: How can I display data in a bar graph for 3 weeks?

udaypulipaka — Tue, 29 Sep 2020 23:13:19 GMT

index="os" sourcetype="Service" CaseNumber= status= assignment=* |dedup _time,CaseNumber,assignment |streamstats current=f last(assignment) as lg, last(active) as Active by CaseNumber|lookup L1Team.csv SS as assigned_to OUTPUT TeamName| eval is_escalated= if(assignment!=lg AND assignment_group="Susta",1,NULL) |eval is_resolved=if(assignment="Susta" AND status="Complete" AND (isnull(Active) OR Active="true"),1,NULL) | bin span=1w _time|stats count(is_escalated) AS "Escalated Cases" count(is_resolved) AS "Resolved Cases" by assigned_to,TeamName,_time| fields - TeamName

I need to create timechart for this.When i give timechart for this query it is not displaying correctly.Please help how to for this with timechart

Re: How can I display data in a bar graph for 3 weeks?

udaypulipaka — Fri, 15 Feb 2019 09:39:27 GMT

Please help how to create a dashboard like above mentioned in image.I want to display the dashboard like this with the query.But iam getting like this