<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Increment Count Totals over a Line Chart in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/Increment-Count-Totals-over-a-Line-Chart/m-p/560058#M38939</link>
    <description>&lt;LI-CODE lang="markup"&gt;| streamstats dc(AssetID) by AssignedDate&lt;/LI-CODE&gt;</description>
    <pubDate>Mon, 19 Jul 2021 13:37:33 GMT</pubDate>
    <dc:creator>ITWhisperer</dc:creator>
    <dc:date>2021-07-19T13:37:33Z</dc:date>
    <item>
      <title>Increment Count Totals over a Line Chart</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Increment-Count-Totals-over-a-Line-Chart/m-p/560049#M38937</link>
      <description>&lt;P&gt;I have a set of data that has a data field inside that shows when an asset has been assigned. Right now, we're pulling the total count of those assets, but have been asked to show an incrementing count over the course of a line chart.&lt;/P&gt;&lt;P&gt;The data looks something like this:&lt;/P&gt;&lt;TABLE border="1" width="100%"&gt;&lt;TBODY&gt;&lt;TR&gt;&lt;TD width="50%" height="25px"&gt;Asset ID&lt;/TD&gt;&lt;TD width="50%" height="25px"&gt;Assigned Date&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD width="50%" height="25px"&gt;123&lt;/TD&gt;&lt;TD width="50%" height="25px"&gt;7/12/21&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD width="50%" height="25px"&gt;124&lt;/TD&gt;&lt;TD width="50%" height="25px"&gt;7/12/21&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD width="50%" height="25px"&gt;125&lt;/TD&gt;&lt;TD width="50%" height="25px"&gt;7/13/21&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD width="50%" height="25px"&gt;126&lt;/TD&gt;&lt;TD width="50%" height="25px"&gt;7/14/21&lt;/TD&gt;&lt;/TR&gt;&lt;/TBODY&gt;&lt;/TABLE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;I want the data in the chart to show like this:&lt;/P&gt;&lt;UL&gt;&lt;LI&gt;7/12/21: 2&lt;/LI&gt;&lt;LI&gt;7/13/21: 3&lt;/LI&gt;&lt;LI&gt;7/13/21: 4&lt;/LI&gt;&lt;/UL&gt;&lt;P&gt;Essentially, after each date from the start, the chart adds the previous dates, and charts the total.&amp;nbsp;&lt;/P&gt;&lt;P&gt;Thanks in advance.&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Mon, 19 Jul 2021 13:14:37 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Increment-Count-Totals-over-a-Line-Chart/m-p/560049#M38937</guid>
      <dc:creator>jzwulf</dc:creator>
      <dc:date>2021-07-19T13:14:37Z</dc:date>
    </item>
    <item>
      <title>Re: Increment Count Totals over a Line Chart</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Increment-Count-Totals-over-a-Line-Chart/m-p/560054#M38938</link>
      <description>&lt;P&gt;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/236567"&gt;@jzwulf&lt;/a&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Can you please try this?&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;YOUR_SEARCH
| streamstats count 
| eventstats max(count) as m by Assigned_Date | where count=m
| table Assigned_Date count&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&lt;STRONG&gt;My Sample Search :&lt;/STRONG&gt;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| makeresults | eval _raw = "Asset ID	Assigned Date
123	7/12/21
124	7/12/21
125	7/13/21
1254	7/13/21
126	7/14/21"| multikv forceheader=1
| table Asset_ID Assigned_Date
| rename comment as "Upto Now is sample data only"
| streamstats count 
| eventstats max(count) as m by Assigned_Date | where count=m
| table Assigned_Date count&lt;/LI-CODE&gt;&lt;P&gt;&lt;BR /&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Thanks&lt;BR /&gt;KV&lt;BR /&gt;▄︻̷̿┻̿═━一 &amp;nbsp; ?&lt;BR /&gt;&lt;BR /&gt;If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.&lt;/P&gt;</description>
      <pubDate>Mon, 19 Jul 2021 13:30:58 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Increment-Count-Totals-over-a-Line-Chart/m-p/560054#M38938</guid>
      <dc:creator>kamlesh_vaghela</dc:creator>
      <dc:date>2021-07-19T13:30:58Z</dc:date>
    </item>
    <item>
      <title>Re: Increment Count Totals over a Line Chart</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Increment-Count-Totals-over-a-Line-Chart/m-p/560058#M38939</link>
      <description>&lt;LI-CODE lang="markup"&gt;| streamstats dc(AssetID) by AssignedDate&lt;/LI-CODE&gt;</description>
      <pubDate>Mon, 19 Jul 2021 13:37:33 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Increment-Count-Totals-over-a-Line-Chart/m-p/560058#M38939</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2021-07-19T13:37:33Z</dc:date>
    </item>
    <item>
      <title>Re: Increment Count Totals over a Line Chart</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Increment-Count-Totals-over-a-Line-Chart/m-p/560094#M38943</link>
      <description>&lt;P&gt;Changed it a bit to fit our actual fields, but this got us there! Thanks a bunch!&lt;/P&gt;</description>
      <pubDate>Mon, 19 Jul 2021 16:52:33 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Increment-Count-Totals-over-a-Line-Chart/m-p/560094#M38943</guid>
      <dc:creator>jzwulf</dc:creator>
      <dc:date>2021-07-19T16:52:33Z</dc:date>
    </item>
  </channel>
</rss>

