https://community.splunk.com/t5/Dashboards-Visualizations/How-to-display-trend-for-3-months/m-p/379440#M42622 <P>@udaypulipaka ,</P> <P>Please accept the answer if it worked for you!.</P> Wed, 13 Feb 2019 06:01:46 GMT vinod94 2019-02-13T06:01:46Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-display-trend-for-3-months/m-p/379435#M42617 <P>Hi,</P> <P>How can i display last 3 months data monthly wise count as trend dashboard.To check whether monthly increasing or decreaing data.</P> <P>index="os" sourcetype="Service" CaseNumber=* status=* assignment=* |dedup _time,CaseNumber,assignment_group| streamstats current=f last(assignment_group) as lg, last(active) as Active by CaseNumber | eval ss=case(assignment!=lg AND assignment="Susta","Escalated",assignment="Susta" AND status="Complete" AND (isnull(Active) OR Active="true"),"Resolved") |timechart count by ss usenull=f</P> <P>How can i display monthly wise count as trend in dashboard</P> Tue, 29 Sep 2020 23:12:45 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-display-trend-for-3-months/m-p/379435#M42617 udaypulipaka 2020-09-29T23:12:45Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-display-trend-for-3-months/m-p/379436#M42618 <P>Try this,</P> <P>You can use span in timechart</P> <P><A href="https://docs.splunk.com/Documentation/SplunkCloud/7.2.3/SearchReference/Timechart">https://docs.splunk.com/Documentation/SplunkCloud/7.2.3/SearchReference/Timechart</A></P> <PRE><CODE>Your search | timechart span=3mon count by ss usenull=f </CODE></PRE> Tue, 12 Feb 2019 09:40:52 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-display-trend-for-3-months/m-p/379436#M42618 vinod94 2019-02-12T09:40:52Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-display-trend-for-3-months/m-p/379437#M42619 <P>index="os" sourcetype="Service" CaseNumber=* status=* assignment=* |dedup _time,CaseNumber,assignment|streamstats current=f last(assignment) as lg, last(active) as Active by CaseNumber | eval is_escalated= if(assignment!=lg AND assignment="Susta",1,NULL)<BR /> |eval is_resolved=if(assignment_group="Susta" AND status="Complete" AND (isnull(Active) OR Active="true"),1,NULL)| chart count(is_escalated) AS "Escalated Cases" count(is_resolved) AS "Resolved Cases" by Component</P> <P>For this query i need linechart.when i add timechart to this query it is showing all the components in below.It looks not gud.So can u help how to do trend for this query.</P> Tue, 29 Sep 2020 23:12:51 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-display-trend-for-3-months/m-p/379437#M42619 udaypulipaka 2020-09-29T23:12:51Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-display-trend-for-3-months/m-p/379438#M42620 <P>can you try this,</P> <PRE><CODE>your search | bin span=3mon _time |stats count(ss) as count by _time </CODE></PRE> Tue, 12 Feb 2019 12:17:11 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-display-trend-for-3-months/m-p/379438#M42620 vinod94 2019-02-12T12:17:11Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-display-trend-for-3-months/m-p/379439#M42621 <P>timechart span=3mon count by ss usenull=f this is working fine.Thank u for your help</P> Tue, 12 Feb 2019 12:40:08 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-display-trend-for-3-months/m-p/379439#M42621 udaypulipaka 2019-02-12T12:40:08Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-display-trend-for-3-months/m-p/379440#M42622 <P>@udaypulipaka ,</P> <P>Please accept the answer if it worked for you!.</P> Wed, 13 Feb 2019 06:01:46 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-display-trend-for-3-months/m-p/379440#M42622 vinod94 2019-02-13T06:01:46Z