I have a chart that displays the Active and Inactive Users for today. I would like to convert this into a timechart which shows data for the selected Period in the Time picker.
index=prod
| stats latest(_time) as last_seen by customerId
| eval status = if(last_seen > relative_time(now(), "-30d@d"),"Active","Inactive")
| chart count by status
| rename count as "User Count"
Please suggest how it could be approached.
@FrankVl : You have helped me with the original query. Could you please guide me here as well?
One way to do that would be to run the search you have, that gives you today's figures, on a daily basis and write the results into a summary index. Then run a timechart over that summary index. But of course, that does require some time to build up data in the summary index before you're able to timechart anything.
Creating a query that directly gives you a timechart of active and inactive users by day is a bit more tricky as that activity is based on a 30d window.
Replacing chart with timechart should do it.
Unfortunately, it is not working. I don't get any results with Timechart. With 'Chart', I get the Active and Inactive count for today.