topic timechart not working in Dashboards & Visualizations

timechart not working

sarit_s — Wed, 29 Nov 2023 10:58:18 GMT

Hello
I have this query :

index="report" Computer_Name="*" |chart dc(Category__Names_of_Patches) as totalNumberOfPatches by Computer_Name | eval exposure_level = case( totalNumberOfPatches >= 3 AND totalNumberOfPatches <= 6, "Low Exposure", totalNumberOfPatches >= 7 AND totalNumberOfPatches <= 10, "Medium Exposure", totalNumberOfPatches >= 11, "High Exposure", totalNumberOfPatches == 2, "Compliant", totalNumberOfPatches == 1, "<not reported>", 1=1,"other" ) | stats count(Computer_Name) as totalNumberOfPatches by exposure_level | eval category=exposure_level

Looks like I've lost the _time field on the way so when im trying to run timechart im getting no results

Re: timechart not working

ITWhisperer — Wed, 29 Nov 2023 11:06:36 GMT

Correct, after the stats command you will only have totalNumberOfPatches and exposure_level. If you need _time after this point it should be added to the by clause, however, you may wish to bin it first, or replace the stats command with timechart

Re: timechart not working

sarit_s — Wed, 29 Nov 2023 11:09:03 GMT

Well, ive changed it to this :

| eval category=exposure_level | timechart span=1d count(Computer_Name) as totalNumberOfPatches by category

but still no results

Re: timechart not working

ITWhisperer — Wed, 29 Nov 2023 11:44:59 GMT

Sorry, I missed the chart command on your first line. This is the command which is removing the timestamps.

Re: timechart not working

sarit_s — Wed, 29 Nov 2023 11:48:16 GMT

so what sould i do ? replacing it with timechart returns also no results

Re: timechart not working

sarit_s — Wed, 29 Nov 2023 11:49:23 GMT

solved it by changing to stats. thanks