topic Re: How to separate two different value for the same date in Dashboards & Visualizations

How to separate two different value for the same date

aditsss — Tue, 08 Aug 2023 20:37:17 GMT

Hi All,

I am using below query to fetch my records:

index="abc*" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-transform/logs/gfp-settlement-transform.log" source="/amex/app/gfp-settlement-transform/logs/gfp-settlement-transform.log" "Server side call completed for Collateral with record count"| rex "Server side call completed for Collateral with record count:\s+(?<record>\d+)"|timechart span=1d values(record) AS RecordCount

I am getting records as below:

How can I separate them .Can someone guide

Re: How to separate two different value for the same date

richgalloway — Tue, 08 Aug 2023 20:58:17 GMT

What do you want the output to look like?

Please re-share the raw events.

Re: How to separate two different value for the same date

aditsss — Tue, 08 Aug 2023 21:07:29 GMT

@richgalloway

raw events:

2023-08-08 10:25:13.067 [INFO ] [Thread-3] CollateralProcessor - Server side call completed for Collateral with record count: 476

2023-08-08 09:56:03.777 [INFO ] [Thread-3] CollateralProcessor - Server side call completed for Collateral with record count: 18541701

I want to fetch both values

Re: How to separate two different value for the same date

bowesmana — Wed, 09 Aug 2023 01:11:42 GMT

It looks like you are collecting both those values, but your timechart command

| timechart span=1d values(record) AS RecordCount

is collecting the individual values of those into the RecordCount field giving you multiple values - do you want to add them together or something else?

timechart span=1d sum(record) AS RecordCount

This will add them together

Re: How to separate two different value for the same date

richgalloway — Wed, 09 Aug 2023 14:21:14 GMT

Thanks for sharing the events.

You *are* collecting both values, but you apparently you are unhappy with how the values are presented. Please describe or provide a mock-up of how you would like the values displayed and we'll try to find a way to accomplish that.

Re: How to separate two different value for the same date

aditsss — Wed, 09 Aug 2023 20:21:32 GMT

@bowesmana

I want to display both of them like on 08/02/2023 both values should be displayed .

But currently I am not able to make any bar chart for it. As two values are coming on one date.

Query:

I want them to come individually along with the date.

Re: How to separate two different value for the same date

bowesmana — Wed, 09 Aug 2023 23:59:40 GMT

Are you saying you want 1 column for each record count for each day in your bar chart? If so, you need to provide a series for each of the rows. There is no need to do an aggregation with timechart.

You can do

... | bin _time span=1d | table _time RecordCount

which will give you a row per event, but you then need to understand how you want to show this