https://community.splunk.com/t5/Splunk-Search/User-due-date-chart-over-time/m-p/532765#M150514 <P>Line Chart:</P><LI-CODE lang="markup">| makeresults | eval name=split("Chris,jill,john",","), due=split("May,Mar,Jan",","), counter=mvrange(0,3) | mvexpand counter | eval NAME=mvindex(name,counter),DUE=strptime("2020".mvindex(due,counter)." 01","%Y%b %d") | reverse | streamstats count | eval _time=DUE | timechart span=1mon values(count) by NAME | appendpipe [ eval _time=relative_time(now(),"@month") | fields _time]</LI-CODE><P>It doesn't work very well.</P> Fri, 11 Dec 2020 09:40:28 GMT to4kawa 2020-12-11T09:40:28Z https://community.splunk.com/t5/Splunk-Search/User-due-date-chart-over-time/m-p/532715#M150500 <P>Hello all!</P><P>I am fairly new to SPLUNK but I wanted to make a chart that would use the X axis for a specified amount of time (span=3y), the Y axis for a list of users, and the plotted data points for due dates unique to that user. Below is a crude example of what I am trying to do...<span class="lia-inline-image-display-wrapper lia-image-align-center" image-alt="SPLUNK_EX.PNG" style="width: 558px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/12250iB61E1DC125F210CE/image-dimensions/558x284?v=v2" width="558" height="284" role="button" title="SPLUNK_EX.PNG" alt="SPLUNK_EX.PNG" /></span></P><P>&nbsp;I've been experimenting with the "timechart" command but I can't seem to figure out how to change the Y axis (if that is even possible). Is there a better way to approach this?</P><P>Any help would be greatly appreciated!</P> Thu, 10 Dec 2020 19:41:53 GMT https://community.splunk.com/t5/Splunk-Search/User-due-date-chart-over-time/m-p/532715#M150500 Colbasaur 2020-12-10T19:41:53Z https://community.splunk.com/t5/Splunk-Search/User-due-date-chart-over-time/m-p/532765#M150514 <P>Line Chart:</P><LI-CODE lang="markup">| makeresults | eval name=split("Chris,jill,john",","), due=split("May,Mar,Jan",","), counter=mvrange(0,3) | mvexpand counter | eval NAME=mvindex(name,counter),DUE=strptime("2020".mvindex(due,counter)." 01","%Y%b %d") | reverse | streamstats count | eval _time=DUE | timechart span=1mon values(count) by NAME | appendpipe [ eval _time=relative_time(now(),"@month") | fields _time]</LI-CODE><P>It doesn't work very well.</P> Fri, 11 Dec 2020 09:40:28 GMT https://community.splunk.com/t5/Splunk-Search/User-due-date-chart-over-time/m-p/532765#M150514 to4kawa 2020-12-11T09:40:28Z