https://community.splunk.com/t5/Dashboards-Visualizations/graph-details/m-p/62125#M3233 <P>index=MyApp earliest=-30d@d-14h | where (date_hour&gt;=10 AND date_hour&lt;22) | bucket _time span=1d | stats count by _time | sort - _time | append [ search index=MyApp earliest=-30d@d-2h | where(date_hour&lt;10 or date_hour&gt;=22) | eval _time=if(date_hour&lt;10, _time-86400, _time) | bucket _time span=1d | stats count by _time | sort - _time]</P> <P>I'm using the query above to generate a graph of the number of tickets for two different support staff shifts. One shift is from 10:00 AM through 10:00 PM. The other shift is from 10:00 PM to 10:00 AM. Ultimately, I want two line graphs of the number of tickets each staff gets (to compare against each other).</P> <P>The graph however is not helpful. Is there a way that I can provide different colors for the lines? Also, the legend has a single entry - "Count". Is there a way to modify or change the legend? Finally, there appears to be a third line (I'm guessing an average??) that appears as well. I don't want that.</P> <P>Thanks in advance.</P> Mon, 28 Sep 2020 09:49:07 GMT DTERM 2020-09-28T09:49:07Z https://community.splunk.com/t5/Dashboards-Visualizations/graph-details/m-p/62125#M3233 <P>index=MyApp earliest=-30d@d-14h | where (date_hour&gt;=10 AND date_hour&lt;22) | bucket _time span=1d | stats count by _time | sort - _time | append [ search index=MyApp earliest=-30d@d-2h | where(date_hour&lt;10 or date_hour&gt;=22) | eval _time=if(date_hour&lt;10, _time-86400, _time) | bucket _time span=1d | stats count by _time | sort - _time]</P> <P>I'm using the query above to generate a graph of the number of tickets for two different support staff shifts. One shift is from 10:00 AM through 10:00 PM. The other shift is from 10:00 PM to 10:00 AM. Ultimately, I want two line graphs of the number of tickets each staff gets (to compare against each other).</P> <P>The graph however is not helpful. Is there a way that I can provide different colors for the lines? Also, the legend has a single entry - "Count". Is there a way to modify or change the legend? Finally, there appears to be a third line (I'm guessing an average??) that appears as well. I don't want that.</P> <P>Thanks in advance.</P> Mon, 28 Sep 2020 09:49:07 GMT https://community.splunk.com/t5/Dashboards-Visualizations/graph-details/m-p/62125#M3233 DTERM 2020-09-28T09:49:07Z https://community.splunk.com/t5/Dashboards-Visualizations/graph-details/m-p/62126#M3234 <P>First, when you do a 'stats' you can use the as option, 'stats count as "DayShift" by _time'.</P><BR /> I am thinking that I would redo your query a bit.<P></P><P></P> <PRE><CODE>index=MyApp earliest=-30d@d-14h | eval Shift=if(10&lt;=date_hour and date_hour&lt;22,"Day","Night") | timechart span=1d count by Shift </CODE></PRE> Tue, 23 Aug 2011 13:14:23 GMT https://community.splunk.com/t5/Dashboards-Visualizations/graph-details/m-p/62126#M3234 fk319 2011-08-23T13:14:23Z https://community.splunk.com/t5/Dashboards-Visualizations/graph-details/m-p/62127#M3235 <P>That is perfect. Thanks.</P> Tue, 23 Aug 2011 17:05:32 GMT https://community.splunk.com/t5/Dashboards-Visualizations/graph-details/m-p/62127#M3235 DTERM 2011-08-23T17:05:32Z