topic Re: How to enhance column chart in Dashboards & Visualizations

How to enhance column chart

a_vobard — Wed, 28 Jul 2021 15:08:20 GMT

Hello,

I have created this search filter:

index=reg host=mp1 "export_successful" | TIMECHART count by "import_successful".

Out of this I have created a column chart for visualization - see below. A the moment it is visualized, if there is every day an successful export (every day there is just one), but I would like to see also, if the export was not successful. What is the easiest way to do it?

Thank you, ava

Re: How to enhance column chart

kamlesh_vaghela — Wed, 28 Jul 2021 15:16:06 GMT

@a_vobard

You can do it with same search. So can you please let us know like "export_successful " events , how do you identify the export unsuccessful?

Re: How to enhance column chart

ITWhisperer — Wed, 28 Jul 2021 15:19:51 GMT

index=reg host=mp1 "export_successful" | timechart count by "export_successful" | eval export_unsuccessful=if(isnull(count),1,null())

Re: How to enhance column chart

a_vobard — Wed, 28 Jul 2021 15:36:37 GMT

Hello, there is no event, if an export was not successful. The only way it can be evaluated is, when the "successful" event is missing. So that seems tricky for me.

Ava

Re: How to enhance column chart

kamlesh_vaghela — Wed, 28 Jul 2021 15:41:08 GMT

Then try creating dummy field unsuccessful_export when count is 0.

| eval unsuccessful_export=if(count==0,1,0)

You can put any count instead of 1 as per your requirement.

🙂

Re: How to enhance column chart

a_vobard — Wed, 28 Jul 2021 15:44:08 GMT

Hello, what does this do exactly? I cannot interpret the "if" part. Thank you.

Re: How to enhance column chart

a_vobard — Wed, 28 Jul 2021 15:45:00 GMT

What exactly is the one?

Re: How to enhance column chart

ITWhisperer — Wed, 28 Jul 2021 16:17:51 GMT

It is supposed to give you an unsuccessful count for when there isn't a successful count, but this isn't going to work unless you fill in the time gaps, so try this

index=reg host=mp1 "export_successful" | timechart count by "export_successful" | makecontinuous _time | eval export_unsuccessful=if(isnull(count),1,null())

Re: How to enhance column chart

a_vobard — Tue, 03 Aug 2021 10:49:35 GMT

Unfortunately this puts a 1 in every column of "export_unsuccessful".

Re: How to enhance column chart

a_vobard — Tue, 03 Aug 2021 10:51:26 GMT

This unfortunately doesn't work. I have everywhere just zero's.