topic Re: How to include another field into the visual in Dashboards & Visualizations

How to include another field into the visual

kelie — Fri, 06 Mar 2020 20:32:06 GMT

I'm working with dashboards and the goal is to show a bar graph panel that displays the counts for two different fields separately
(2 bars per timespan) if possible.
The data is from the same index...the actions field(action=blocked) and category field (category=221)

I can build a visual for each individual field but having trouble combining the two.

index=url_filter action=blocked login_id="$user$"|stats count by _time |bucket _time span=1h

I have another field not exclusive to field [action=blocked] that id like to display as well.
Any tips appreciated.

Re: How to include another field into the visual

woodcock — Fri, 06 Mar 2020 21:54:07 GMT

Like this:

index="url_filter" AND login_id="$user$" AND (action="blocked" OR category="221")
| bucket _time span=1h
| stats count(eval(action="blocked")) AS blocked count(eval(category="221")) AS count221 BY _time

index="url_filter" AND login_id="$user$" AND (action="blocked" OR category="221")
| timechart span=1h count(eval(action="blocked")) AS blocked count(eval(category="221")) AS count221

Re: How to include another field into the visual

somesoni2 — Fri, 06 Mar 2020 22:00:38 GMT

Try like this (assuming calculation of count independently for both conditions). You didn't provide a query for calculation of category=221, I'm just using filter based on field category, adjust the query per yours)

index=url_filter (action=blocked login_id="$user$") OR (category=221)
| eval CountBlocked=if(action="blocked",1,0) , CountCat221=if(category=221,1,0)
| timechart span=1h sum(CountBlocked) as CountBlocked sum(CountCat221) as CountCat221

Re: How to include another field into the visual

kelie — Wed, 30 Sep 2020 04:30:51 GMT

sorry for leaving it out but a sample search for category would have been

index=url_filter category=221 login_id="$user$"|stats count by _time |bucket _time span=1h

these answers have definitely put me on the right track with the eval

Re: How to include another field into the visual

woodcock — Fri, 06 Mar 2020 22:44:47 GMT

Do the bucket earlier. See my answer.

Re: How to include another field into the visual

kelie — Mon, 09 Mar 2020 16:36:49 GMT

this solution worked and is simplified, than you both for the answers

Re: How to include another field into the visual

woodcock — Mon, 09 Mar 2020 17:43:20 GMT

Be sure to come back here and click Accept to close the question and also UpVote any answers or comments that were useful.