https://community.splunk.com/t5/Dashboards-Visualizations/How-do-I-make-a-different-bar-chart-for-each-day-in-a-given/m-p/422379#M27854 <P>Thanks for the info, but let’s say if I want to compare last 7days should I keep on renaming all the days If so I think there should be a better way. Thanks</P> Wed, 10 Oct 2018 17:07:28 GMT sandeepmakkena 2018-10-10T17:07:28Z https://community.splunk.com/t5/Dashboards-Visualizations/How-do-I-make-a-different-bar-chart-for-each-day-in-a-given/m-p/422375#M27850 <P>mysearch</P> <PRE><CODE>| eval Status=if(like(_raw, "%POSTING:SUCCEEDED%"), "2.Successful transactions" , "1.Rejected Transactions") | timechart count by Status span=1hr | timewrap 1day </CODE></PRE> <P>I am trying to compare today's total successful transactions and rejected transactions with past 2days, past3days...past7days. I am trying to use the above query, but it is getting me a separate bar graph from successful and rejected( I want them to be stacked) Please help me achieve this. <BR /> Thank you.,</P> Wed, 10 Oct 2018 15:32:58 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-do-I-make-a-different-bar-chart-for-each-day-in-a-given/m-p/422375#M27850 sandeepmakkena 2018-10-10T15:32:58Z https://community.splunk.com/t5/Dashboards-Visualizations/How-do-I-make-a-different-bar-chart-for-each-day-in-a-given/m-p/422376#M27851 <P>You can change the format to stack mode from Visualization format. </P> Wed, 10 Oct 2018 15:46:53 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-do-I-make-a-different-bar-chart-for-each-day-in-a-given/m-p/422376#M27851 Vijeta 2018-10-10T15:46:53Z https://community.splunk.com/t5/Dashboards-Visualizations/How-do-I-make-a-different-bar-chart-for-each-day-in-a-given/m-p/422377#M27852 <P>I tried that it didnot work. It is giving me a big bar graph will all days selected with different colors. </P> Wed, 10 Oct 2018 15:55:32 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-do-I-make-a-different-bar-chart-for-each-day-in-a-given/m-p/422377#M27852 sandeepmakkena 2018-10-10T15:55:32Z https://community.splunk.com/t5/Dashboards-Visualizations/How-do-I-make-a-different-bar-chart-for-each-day-in-a-given/m-p/422378#M27853 <P>You need to combine last 2 days as one , you can do that by renaming and eval. Also since you are comparing current date with last 2 days <BR /> |rename "2.Successful transactions_1day_before" as Last_Success_1, rename "1.Rejected Transactions_1day_before" as Last_Rejected_1, "2.Successful transactions_2day_before" as Last_Success_2, rename "1.Rejected Ttransactions_2day_before" as Last_Rejected_2<BR /> |eval Last_Success=Last_Success_1 + Last_Success_2<BR /> |eval Last_Rejected= Last_Rejected_1 + Last_Rejected_2<BR /> | fields _time Last_Success Last_Rejected 2.Successful transactions_latest_day "1.Rejected Transactions_latest_day"</P> Tue, 29 Sep 2020 21:35:31 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-do-I-make-a-different-bar-chart-for-each-day-in-a-given/m-p/422378#M27853 Vijeta 2020-09-29T21:35:31Z https://community.splunk.com/t5/Dashboards-Visualizations/How-do-I-make-a-different-bar-chart-for-each-day-in-a-given/m-p/422379#M27854 <P>Thanks for the info, but let’s say if I want to compare last 7days should I keep on renaming all the days If so I think there should be a better way. Thanks</P> Wed, 10 Oct 2018 17:07:28 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-do-I-make-a-different-bar-chart-for-each-day-in-a-given/m-p/422379#M27854 sandeepmakkena 2018-10-10T17:07:28Z