topic Re: Active vs Inactive Users in a Timechart in Dashboards & Visualizations

Active vs Inactive Users in a Timechart

rajkskumar — Mon, 09 Nov 2020 09:05:16 GMT

I have a chart that displays the Active and Inactive Users for today. I would like to convert this into a timechart which shows data for the selected Period in the Time picker.

index=prod | stats latest(_time) as last_seen by customerId | eval status = if(last_seen > relative_time(now(), "-30d@d"),"Active","Inactive") | chart count by status | rename count as "User Count"

Please suggest how it could be approached.

@FrankVl : You have helped me with the original query. Could you please guide me here as well?

Re: Active vs Inactive Users in a Timechart

richgalloway — Fri, 06 Nov 2020 18:00:16 GMT

Replacing chart with timechart should do it.

Re: Active vs Inactive Users in a Timechart

rajkskumar — Sat, 07 Nov 2020 17:34:03 GMT

Unfortunately, it is not working. I don't get any results with Timechart. With 'Chart', I get the Active and Inactive count for today.

Re: Active vs Inactive Users in a Timechart

FrankVl — Fri, 20 Nov 2020 08:52:45 GMT

One way to do that would be to run the search you have, that gives you today's figures, on a daily basis and write the results into a summary index. Then run a timechart over that summary index. But of course, that does require some time to build up data in the summary index before you're able to timechart anything.

Creating a query that directly gives you a timechart of active and inactive users by day is a bit more tricky as that activity is based on a 30d window.