Dashboards & Visualizations

How can I display data in a bar graph for 3 weeks?

udaypulipaka
Observer

Hi,

I need to display data person wise for 3 weeks in a bar chart. Please find the attached required dashboard image for a better understanding.alt text

My Query is:

index="os" sourcetype="Service"  CaseNumber=* status=*  assignment=* |dedup _time,CaseNumber,assignment |streamstats current=f last(assignment) as lg, last(active) as  Active by CaseNumber|lookup L1Team.csv SS as assigned_to OUTPUT TeamName| eval is_escalated= if(assignment!=lg AND assignment_group="Susta",1,NULL) |eval is_resolved=if(assignment="Susta" AND status="Complete" AND (isnull(Active) OR Active="true"),1,NULL) | stats count(is_escalated) AS "Escalated Cases" count(is_resolved) AS "Resolved Cases" by assigned_to,TeamName| fields - TeamName

How do you make a dashboard in that way?

Tags (2)
0 Karma

udaypulipaka
Observer

Please help how to create a dashboard like above mentioned in image.I want to display the dashboard like this with the query.But iam getting like this
alt text

0 Karma

Vijeta
Influencer

Try this

index="os" sourcetype="Service" CaseNumber= status= assignment=* |dedup _time,CaseNumber,assignment |streamstats current=f last(assignment) as lg, last(active) as Active by CaseNumber|lookup L1Team.csv SS as assigned_to OUTPUT TeamName| eval is_escalated= if(assignment!=lg AND assignment_group="Susta",1,NULL) |eval is_resolved=if(assignment="Susta" AND status="Complete" AND (isnull(Active) OR Active="true"),1,NULL) | bin span=1w _time|stats count(is_escalated) AS "Escalated Cases" count(is_resolved) AS "Resolved Cases" by assigned_to,TeamName,_time| fields - TeamName
0 Karma

udaypulipaka
Observer

But it will display for 1 weak data right. I want to display data for 3 weaks like I send in image.i want dashboard should display like that in image.how can create that dashboard like that

0 Karma

Vijeta
Influencer

you need to use your earliest time as -3w and latest time as now,it will give you each weeks data for that time span.

0 Karma

udaypulipaka
Observer

index="os" sourcetype="Service" CaseNumber= status= assignment=* |dedup _time,CaseNumber,assignment |streamstats current=f last(assignment) as lg, last(active) as Active by CaseNumber|lookup L1Team.csv SS as assigned_to OUTPUT TeamName| eval is_escalated= if(assignment!=lg AND assignment_group="Susta",1,NULL) |eval is_resolved=if(assignment="Susta" AND status="Complete" AND (isnull(Active) OR Active="true"),1,NULL) | bin span=1w _time|stats count(is_escalated) AS "Escalated Cases" count(is_resolved) AS "Resolved Cases" by assigned_to,TeamName,_time| fields - TeamName

I need to create timechart for this.When i give timechart for this query it is not displaying correctly.Please help how to for this with timechart

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...