<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How to get a column chart to show count between two dates?? in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/How-to-get-a-column-chart-to-show-count-between-two-dates/m-p/504417#M140795</link>
    <description>&lt;P&gt;sample2:&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| tstats count where index=_internal sourcetype!=splunkd*  earliest=1 by _time span=1d sourcetype
| stats sum(count) as count min(_time) as start max(_time) as end by sourcetype
| convert ctime(start) ctime(end) timeformat="%m/%d/%Y"
| eval times=start."-".end
| xyseries  times sourcetype count&lt;/LI-CODE&gt;&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="column chart with stack by percentage" style="width: 999px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/9190i58B85D4EB92DB552/image-size/large?v=v2&amp;amp;px=999" role="button" title="スクリーンショット 2020-06-15 21.12.20.png" alt="column chart with stack by percentage" /&gt;&lt;span class="lia-inline-image-caption" onclick="event.preventDefault();"&gt;column chart with stack by percentage&lt;/span&gt;&lt;/span&gt;&lt;/P&gt;</description>
    <pubDate>Mon, 15 Jun 2020 12:13:26 GMT</pubDate>
    <dc:creator>to4kawa</dc:creator>
    <dc:date>2020-06-15T12:13:26Z</dc:date>
    <item>
      <title>How to get a column chart to show count between two dates??</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-get-a-column-chart-to-show-count-between-two-dates/m-p/504391#M140789</link>
      <description>&lt;DIV class="lia-quilt-row lia-quilt-row-main"&gt;
&lt;DIV class="lia-quilt-column lia-quilt-column-24 lia-quilt-column-single lia-quilt-column-main-content"&gt;
&lt;DIV class="lia-quilt-column-alley lia-quilt-column-alley-single"&gt;
&lt;DIV class="lia-panel lia-panel-section lia-component-editor"&gt;
&lt;DIV class="lia-decoration-border"&gt;
&lt;DIV class="lia-decoration-border-content"&gt;
&lt;DIV class="lia-panel-content-wrapper"&gt;
&lt;DIV class="lia-panel-content"&gt;
&lt;DIV class="lia-panel-message message-uid-504384"&gt;
&lt;DIV class="lia-message-view-wrapper lia-js-data-messageUid-504384 lia-component-forums-widget-message-view-two"&gt;
&lt;DIV class="MessageView lia-message-view-forum-message lia-message-view-display lia-row-standard-unread lia-thread-topic lia-message-authored-by-you"&gt;
&lt;DIV class="lia-quilt lia-quilt-forum-message lia-quilt-layout-custom-forum-messages"&gt;
&lt;DIV class="lia-quilt-row lia-quilt-row-message-body"&gt;
&lt;DIV class="lia-quilt-column lia-quilt-column-24 lia-quilt-column-single lia-quilt-column-message-body-content"&gt;
&lt;DIV class="lia-quilt-column-alley lia-quilt-column-alley-single"&gt;
&lt;DIV class="lia-message-body lia-component-message-view-widget-body lia-component-body-signature-highlight-escalation lia-component-message-view-widget-body-signature-highlight-escalation"&gt;
&lt;DIV class="lia-message-body-content"&gt;
&lt;P&gt;Hi everyone, hope u r all doing good.&lt;/P&gt;
&lt;P&gt;So i have a query i am not able to figure out.I need to show a visualisation of column chart which shows each bar containing data between two dates. I'll explain it clearly.&amp;nbsp;&lt;/P&gt;
&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="IMG_20200615_144333__01__01.jpg" style="width: 4000px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/9186i8516372E84E0A1AD/image-size/medium?v=v2&amp;amp;px=400" role="button" title="IMG_20200615_144333__01__01.jpg" alt="IMG_20200615_144333__01__01.jpg" /&gt;&lt;/span&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;As u can see in the picture i&amp;nbsp; attached...it shows a timeline visualisation and data between two dates 6/9/2020-6/23/2020.&lt;/P&gt;
&lt;P&gt;In the exact same way i want to show on a column chart. So that later if i add any data between those dates for ex. On 6/15/2020 and 6/16/2020 etc....and if i overlay it , it should show me a line chart on that column chart.I hope i am clear if not plz tell me.&lt;/P&gt;
&lt;P&gt;So the query that I used for that timeline graph is:&lt;/P&gt;
&lt;LI-CODE lang="markup"&gt;Index= main sourcetype= timeline | rename "beginning_date" as start_date | rename "ending_date" as end_date | eval _time= strptime(start_date, "%m/%d/%Y") | eval end_time= strptime(end_date, "%m/%d/%Y") | eval duration = (end_time - _time) * 1000 | eval duration = IF(duration &amp;lt; 86400000, 0, duration) | stats count by _time, duration, "target" | table _time "target" duration&lt;/LI-CODE&gt;
&lt;P&gt;so most of this query is from the timeline gallery example dashboard in Splunk. I don't think duration work with a column chart to show 6/9/2020-6/23/2020 format like this.&amp;nbsp;&lt;/P&gt;
&lt;P&gt;I have two fields&amp;nbsp;&lt;/P&gt;
&lt;P&gt;Beginning_date.&amp;nbsp; &amp;nbsp; &amp;nbsp;Ending_date&lt;/P&gt;
&lt;P&gt;6/9/2020.&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; 6/23/2020&lt;/P&gt;
&lt;P&gt;Like this and I need to show something like the below pic:&lt;/P&gt;
&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="IMG_20200615_165452.jpg" style="width: 4000px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/9189i6A63C9F2FC9F2F9F/image-size/medium?v=v2&amp;amp;px=400" role="button" title="IMG_20200615_165452.jpg" alt="IMG_20200615_165452.jpg" /&gt;&lt;/span&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;It would be really helpful if anyone could help me with this. Thanks.&amp;nbsp;&lt;/P&gt;
&lt;/DIV&gt;
&lt;/DIV&gt;
&lt;/DIV&gt;
&lt;/DIV&gt;
&lt;/DIV&gt;
&lt;/DIV&gt;
&lt;/DIV&gt;
&lt;/DIV&gt;
&lt;/DIV&gt;
&lt;/DIV&gt;
&lt;/DIV&gt;
&lt;/DIV&gt;
&lt;/DIV&gt;
&lt;/DIV&gt;
&lt;/DIV&gt;
&lt;/DIV&gt;
&lt;/DIV&gt;
&lt;DIV class="lia-quilt-row lia-quilt-row-footer"&gt;
&lt;DIV class="lia-quilt-column lia-quilt-column-24 lia-quilt-column-single lia-quilt-column-common-footer"&gt;
&lt;DIV class="lia-quilt-column-alley lia-quilt-column-alley-single"&gt;
&lt;DIV class="lia-quilt lia-quilt-footer lia-quilt-layout-footer lia-component-quilt-footer"&gt;
&lt;DIV class="lia-quilt-row lia-quilt-row-main"&gt;
&lt;DIV class="lia-quilt-column lia-quilt-column-24 lia-quilt-column-single lia-quilt-column-icons"&gt;
&lt;DIV class="lia-quilt-column-alley lia-quilt-column-alley-single"&gt;
&lt;DIV class="li-common-scroll-to-wrapper"&gt;&amp;nbsp;&lt;/DIV&gt;
&lt;/DIV&gt;
&lt;/DIV&gt;
&lt;/DIV&gt;
&lt;/DIV&gt;
&lt;/DIV&gt;
&lt;/DIV&gt;
&lt;/DIV&gt;</description>
      <pubDate>Mon, 15 Jun 2020 20:35:19 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-get-a-column-chart-to-show-count-between-two-dates/m-p/504391#M140789</guid>
      <dc:creator>nikitha15</dc:creator>
      <dc:date>2020-06-15T20:35:19Z</dc:date>
    </item>
    <item>
      <title>Re: How to get a column chart to show count between two dates??</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-get-a-column-chart-to-show-count-between-two-dates/m-p/504397#M140790</link>
      <description>&lt;P&gt;sample:&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| tstats count where index=_internal sourcetype!=splunkd*  earliest=1 by _time span=1d sourcetype
| stats dc(sourcetype) as count by _time sourcetype
| xyseries _time sourcetype count&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Column Chart" style="width: 999px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/9188i7A8CAFACE0E45F04/image-size/large?v=v2&amp;amp;px=999" role="button" title="ans1.png" alt="Column Chart" /&gt;&lt;span class="lia-inline-image-caption" onclick="event.preventDefault();"&gt;Column Chart&lt;/span&gt;&lt;/span&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;How about this image?&lt;/P&gt;</description>
      <pubDate>Mon, 15 Jun 2020 10:53:38 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-get-a-column-chart-to-show-count-between-two-dates/m-p/504397#M140790</guid>
      <dc:creator>to4kawa</dc:creator>
      <dc:date>2020-06-15T10:53:38Z</dc:date>
    </item>
    <item>
      <title>Re: How to get a column chart to show count between two dates??</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-get-a-column-chart-to-show-count-between-two-dates/m-p/504410#M140793</link>
      <description>&lt;P&gt;Hi...i dnt think that is the way i want it to show. I have updated my question and added a pic ...plz check.&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Mon, 15 Jun 2020 11:37:08 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-get-a-column-chart-to-show-count-between-two-dates/m-p/504410#M140793</guid>
      <dc:creator>nikitha15</dc:creator>
      <dc:date>2020-06-15T11:37:08Z</dc:date>
    </item>
    <item>
      <title>Re: How to get a column chart to show count between two dates??</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-get-a-column-chart-to-show-count-between-two-dates/m-p/504417#M140795</link>
      <description>&lt;P&gt;sample2:&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| tstats count where index=_internal sourcetype!=splunkd*  earliest=1 by _time span=1d sourcetype
| stats sum(count) as count min(_time) as start max(_time) as end by sourcetype
| convert ctime(start) ctime(end) timeformat="%m/%d/%Y"
| eval times=start."-".end
| xyseries  times sourcetype count&lt;/LI-CODE&gt;&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="column chart with stack by percentage" style="width: 999px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/9190i58B85D4EB92DB552/image-size/large?v=v2&amp;amp;px=999" role="button" title="スクリーンショット 2020-06-15 21.12.20.png" alt="column chart with stack by percentage" /&gt;&lt;span class="lia-inline-image-caption" onclick="event.preventDefault();"&gt;column chart with stack by percentage&lt;/span&gt;&lt;/span&gt;&lt;/P&gt;</description>
      <pubDate>Mon, 15 Jun 2020 12:13:26 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-get-a-column-chart-to-show-count-between-two-dates/m-p/504417#M140795</guid>
      <dc:creator>to4kawa</dc:creator>
      <dc:date>2020-06-15T12:13:26Z</dc:date>
    </item>
    <item>
      <title>Re: How to get a column chart to show count between two dates??</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-get-a-column-chart-to-show-count-between-two-dates/m-p/504436#M140797</link>
      <description>&lt;P&gt;Hi...ya this is working but one thing. Does this only work for _time , bcoz i have dates in a seperate field that i have created and if i give that field name it's not working. Or is it bcoz, i created that field so the dates are in a string format and not date format???can u plz help me with this&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Mon, 15 Jun 2020 13:52:20 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-get-a-column-chart-to-show-count-between-two-dates/m-p/504436#M140797</guid>
      <dc:creator>nikitha15</dc:creator>
      <dc:date>2020-06-15T13:52:20Z</dc:date>
    </item>
    <item>
      <title>Re: How to get a column chart to show count between two dates??</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-get-a-column-chart-to-show-count-between-two-dates/m-p/504498#M140850</link>
      <description>&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;Index= main sourcetype= timeline 
| eval dates=beginning_date."-".ending_date
| stats count by dates, target 
| xyseries dates target count&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&lt;A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval" target="_self"&gt;https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval&lt;/A&gt;&lt;/P&gt;&lt;P&gt;You can fix the rest.&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Mon, 15 Jun 2020 21:09:53 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-get-a-column-chart-to-show-count-between-two-dates/m-p/504498#M140850</guid>
      <dc:creator>to4kawa</dc:creator>
      <dc:date>2020-06-15T21:09:53Z</dc:date>
    </item>
  </channel>
</rss>

