How can I display data in a bar graph for 3 weeks?

[udaypulipaka]

Hi,

I need to display data person wise for 3 weeks in a bar chart. Please find the attached required dashboard image for a better understanding.

My Query is:

index="os" sourcetype="Service"  CaseNumber=* status=*  assignment=* |dedup _time,CaseNumber,assignment |streamstats current=f last(assignment) as lg, last(active) as  Active by CaseNumber|lookup L1Team.csv SS as assigned_to OUTPUT TeamName| eval is_escalated= if(assignment!=lg AND assignment_group="Susta",1,NULL) |eval is_resolved=if(assignment="Susta" AND status="Complete" AND (isnull(Active) OR Active="true"),1,NULL) | stats count(is_escalated) AS "Escalated Cases" count(is_resolved) AS "Resolved Cases" by assigned_to,TeamName| fields - TeamName

How do you make a dashboard in that way?

[udaypulipaka]

Please help how to create a dashboard like above mentioned in image.I want to display the dashboard like this with the query.But iam getting like this

[Vijeta]

Try this

index="os" sourcetype="Service" CaseNumber= status= assignment=* |dedup _time,CaseNumber,assignment |streamstats current=f last(assignment) as lg, last(active) as Active by CaseNumber|lookup L1Team.csv SS as assigned_to OUTPUT TeamName| eval is_escalated= if(assignment!=lg AND assignment_group="Susta",1,NULL) |eval is_resolved=if(assignment="Susta" AND status="Complete" AND (isnull(Active) OR Active="true"),1,NULL) | bin span=1w _time|stats count(is_escalated) AS "Escalated Cases" count(is_resolved) AS "Resolved Cases" by assigned_to,TeamName,_time| fields - TeamName

[udaypulipaka]

But it will display for 1 weak data right. I want to display data for 3 weaks like I send in image.i want dashboard should display like that in image.how can create that dashboard like that

[Vijeta]

you need to use your earliest time as -3w and latest time as now,it will give you each weeks data for that time span.

[udaypulipaka]

index="os" sourcetype="Service" CaseNumber= status= assignment=* |dedup _time,CaseNumber,assignment |streamstats current=f last(assignment) as lg, last(active) as Active by CaseNumber|lookup L1Team.csv SS as assigned_to OUTPUT TeamName| eval is_escalated= if(assignment!=lg AND assignment_group="Susta",1,NULL) |eval is_resolved=if(assignment="Susta" AND status="Complete" AND (isnull(Active) OR Active="true"),1,NULL) | bin span=1w _time|stats count(is_escalated) AS "Escalated Cases" count(is_resolved) AS "Resolved Cases" by assigned_to,TeamName,_time| fields - TeamName

I need to create timechart for this.When i give timechart for this query it is not displaying correctly.Please help how to for this with timechart