<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic When counting by _time how can you show the previous hours stats value if there is no events during a hour? in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/When-counting-by-time-how-can-you-show-the-previous-hours-stats/m-p/612442#M50235</link>
    <description>&lt;P&gt;I am creating a two column, column chart comparing how many necklaces we made (column 1) vs. how many we need (column 2). The chart is split up by hour starting from&amp;nbsp;@d-22h to now(). Yet, if no necklaces are created during a hour, the columns will not be produced and will leave a blank space.&lt;BR /&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;FONT color="#800000"&gt;&lt;U&gt;&lt;STRONG&gt;If no events in a hour: &lt;/STRONG&gt;&lt;/U&gt;&lt;/FONT&gt;&lt;/P&gt;
&lt;P&gt;&lt;STRONG&gt;Necklaces made=constant value&lt;/STRONG&gt; of necklace made during last event hour (constant)&lt;/P&gt;
&lt;P&gt;&lt;STRONG&gt;Goal= hour*60&lt;/STRONG&gt; (increase by 60 every hour)&lt;/P&gt;
&lt;P&gt;&lt;U&gt;current chart:&lt;/U&gt;&lt;/P&gt;
&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="ichesla1111_0-1662652861982.png" style="width: 400px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/21395iBCEB927D52252D08/image-size/medium?v=v2&amp;amp;px=400" role="button" title="ichesla1111_0-1662652861982.png" alt="ichesla1111_0-1662652861982.png" /&gt;&lt;/span&gt;&lt;/P&gt;
&lt;P&gt;&lt;U&gt;What I want:&lt;/U&gt;&lt;/P&gt;
&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="ichesla1111_1-1662653095558.png" style="width: 400px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/21396i9815792FD29715C3/image-size/medium?v=v2&amp;amp;px=400" role="button" title="ichesla1111_1-1662653095558.png" alt="ichesla1111_1-1662653095558.png" /&gt;&lt;/span&gt;&lt;/P&gt;
&lt;P&gt;Purple rectangles=646 (constant)&lt;BR /&gt;Orange rectangles= previous Goal value +60 (box1=540+60; box2=600+60)&lt;BR /&gt;&lt;BR /&gt;Code: ------------------------------------------------------------------------&lt;BR /&gt;&lt;BR /&gt;|makeresults|eval early_relative = "@d-2h"|eval late = "@d+22h"&lt;BR /&gt;|eval date_hour=strftime(now(),"%H")&lt;BR /&gt;|eval timeofday=case((date_hour&amp;gt;=22 AND date_hour&amp;lt;=23),"@d+22h,now",(date_hour&amp;gt;=0 AND date_hour&amp;lt;22),"@d-2h,now")&lt;BR /&gt;|eval split=split(timeofday,",")&lt;BR /&gt;|eval early_relative=mvindex(split,0)&lt;BR /&gt;|eval early_date=strftime(relative_time(now(),early_relative),"%m/%d/%y %H:%M:%S")&lt;BR /&gt;|eval late = if(mvindex(split,1)="now",now(),relative_time(now(),mvindex(split,1)))&lt;BR /&gt;|eval late_date = strftime(if(mvindex(split,1)="now",now(),relative_time(now(),mvindex(split,1))),"%m/%d/%y %H:%M:%S")&lt;BR /&gt;|eval test = strftime(late,"%m/%d/%y %H:%M:%S")&lt;BR /&gt;&lt;BR /&gt;&lt;BR /&gt;|map search="search index=..... earliest=\"$early_relative$\" latest=$late$&lt;BR /&gt;|eval hour=1|eval date_hour=strftime(now(),\"%H\")&lt;BR /&gt;|eval timeofday=case((date_hour&amp;gt;=22 AND date_hour&amp;lt;=23),\"@d+22h,now\",(date_hour&amp;gt;=0 AND date_hour&amp;lt;22),\"@d-2h,now\")&lt;BR /&gt;|eval late=$late_date$&lt;BR /&gt;|eval early=$early_date$&lt;BR /&gt;|bucket _time span=1h&lt;BR /&gt;|eval Time=strftime(_time,\"%H\")&lt;BR /&gt;|eval Goal_hour=case((Time=22),1,(Time=23),2,(Time&amp;gt;=0 AND Time&amp;lt;22),Time+3)&lt;BR /&gt;|eval Goal=Goal_hour*60&lt;BR /&gt;|stats count(Neckles) as Actual_Made by _time Goal |accum Actual_Made"&lt;BR /&gt;-----------------------------------------------------------------------&lt;BR /&gt;&lt;BR /&gt;Please help!!! Thank you.&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
    <pubDate>Thu, 08 Sep 2022 16:55:45 GMT</pubDate>
    <dc:creator>ichesla1111</dc:creator>
    <dc:date>2022-09-08T16:55:45Z</dc:date>
    <item>
      <title>When counting by _time how can you show the previous hours stats value if there is no events during a hour?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/When-counting-by-time-how-can-you-show-the-previous-hours-stats/m-p/612442#M50235</link>
      <description>&lt;P&gt;I am creating a two column, column chart comparing how many necklaces we made (column 1) vs. how many we need (column 2). The chart is split up by hour starting from&amp;nbsp;@d-22h to now(). Yet, if no necklaces are created during a hour, the columns will not be produced and will leave a blank space.&lt;BR /&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;FONT color="#800000"&gt;&lt;U&gt;&lt;STRONG&gt;If no events in a hour: &lt;/STRONG&gt;&lt;/U&gt;&lt;/FONT&gt;&lt;/P&gt;
&lt;P&gt;&lt;STRONG&gt;Necklaces made=constant value&lt;/STRONG&gt; of necklace made during last event hour (constant)&lt;/P&gt;
&lt;P&gt;&lt;STRONG&gt;Goal= hour*60&lt;/STRONG&gt; (increase by 60 every hour)&lt;/P&gt;
&lt;P&gt;&lt;U&gt;current chart:&lt;/U&gt;&lt;/P&gt;
&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="ichesla1111_0-1662652861982.png" style="width: 400px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/21395iBCEB927D52252D08/image-size/medium?v=v2&amp;amp;px=400" role="button" title="ichesla1111_0-1662652861982.png" alt="ichesla1111_0-1662652861982.png" /&gt;&lt;/span&gt;&lt;/P&gt;
&lt;P&gt;&lt;U&gt;What I want:&lt;/U&gt;&lt;/P&gt;
&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="ichesla1111_1-1662653095558.png" style="width: 400px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/21396i9815792FD29715C3/image-size/medium?v=v2&amp;amp;px=400" role="button" title="ichesla1111_1-1662653095558.png" alt="ichesla1111_1-1662653095558.png" /&gt;&lt;/span&gt;&lt;/P&gt;
&lt;P&gt;Purple rectangles=646 (constant)&lt;BR /&gt;Orange rectangles= previous Goal value +60 (box1=540+60; box2=600+60)&lt;BR /&gt;&lt;BR /&gt;Code: ------------------------------------------------------------------------&lt;BR /&gt;&lt;BR /&gt;|makeresults|eval early_relative = "@d-2h"|eval late = "@d+22h"&lt;BR /&gt;|eval date_hour=strftime(now(),"%H")&lt;BR /&gt;|eval timeofday=case((date_hour&amp;gt;=22 AND date_hour&amp;lt;=23),"@d+22h,now",(date_hour&amp;gt;=0 AND date_hour&amp;lt;22),"@d-2h,now")&lt;BR /&gt;|eval split=split(timeofday,",")&lt;BR /&gt;|eval early_relative=mvindex(split,0)&lt;BR /&gt;|eval early_date=strftime(relative_time(now(),early_relative),"%m/%d/%y %H:%M:%S")&lt;BR /&gt;|eval late = if(mvindex(split,1)="now",now(),relative_time(now(),mvindex(split,1)))&lt;BR /&gt;|eval late_date = strftime(if(mvindex(split,1)="now",now(),relative_time(now(),mvindex(split,1))),"%m/%d/%y %H:%M:%S")&lt;BR /&gt;|eval test = strftime(late,"%m/%d/%y %H:%M:%S")&lt;BR /&gt;&lt;BR /&gt;&lt;BR /&gt;|map search="search index=..... earliest=\"$early_relative$\" latest=$late$&lt;BR /&gt;|eval hour=1|eval date_hour=strftime(now(),\"%H\")&lt;BR /&gt;|eval timeofday=case((date_hour&amp;gt;=22 AND date_hour&amp;lt;=23),\"@d+22h,now\",(date_hour&amp;gt;=0 AND date_hour&amp;lt;22),\"@d-2h,now\")&lt;BR /&gt;|eval late=$late_date$&lt;BR /&gt;|eval early=$early_date$&lt;BR /&gt;|bucket _time span=1h&lt;BR /&gt;|eval Time=strftime(_time,\"%H\")&lt;BR /&gt;|eval Goal_hour=case((Time=22),1,(Time=23),2,(Time&amp;gt;=0 AND Time&amp;lt;22),Time+3)&lt;BR /&gt;|eval Goal=Goal_hour*60&lt;BR /&gt;|stats count(Neckles) as Actual_Made by _time Goal |accum Actual_Made"&lt;BR /&gt;-----------------------------------------------------------------------&lt;BR /&gt;&lt;BR /&gt;Please help!!! Thank you.&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Thu, 08 Sep 2022 16:55:45 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/When-counting-by-time-how-can-you-show-the-previous-hours-stats/m-p/612442#M50235</guid>
      <dc:creator>ichesla1111</dc:creator>
      <dc:date>2022-09-08T16:55:45Z</dc:date>
    </item>
  </channel>
</rss>

