Dashboards & Visualizations

How can I display data in a bar graph for 3 weeks?

udaypulipaka
Observer

Hi,

I need to display data person wise for 3 weeks in a bar chart. Please find the attached required dashboard image for a better understanding.alt text

My Query is:

index="os" sourcetype="Service"  CaseNumber=* status=*  assignment=* |dedup _time,CaseNumber,assignment |streamstats current=f last(assignment) as lg, last(active) as  Active by CaseNumber|lookup L1Team.csv SS as assigned_to OUTPUT TeamName| eval is_escalated= if(assignment!=lg AND assignment_group="Susta",1,NULL) |eval is_resolved=if(assignment="Susta" AND status="Complete" AND (isnull(Active) OR Active="true"),1,NULL) | stats count(is_escalated) AS "Escalated Cases" count(is_resolved) AS "Resolved Cases" by assigned_to,TeamName| fields - TeamName

How do you make a dashboard in that way?

Tags (2)
0 Karma

udaypulipaka
Observer

Please help how to create a dashboard like above mentioned in image.I want to display the dashboard like this with the query.But iam getting like this
alt text

0 Karma

Vijeta
Influencer

Try this

index="os" sourcetype="Service" CaseNumber= status= assignment=* |dedup _time,CaseNumber,assignment |streamstats current=f last(assignment) as lg, last(active) as Active by CaseNumber|lookup L1Team.csv SS as assigned_to OUTPUT TeamName| eval is_escalated= if(assignment!=lg AND assignment_group="Susta",1,NULL) |eval is_resolved=if(assignment="Susta" AND status="Complete" AND (isnull(Active) OR Active="true"),1,NULL) | bin span=1w _time|stats count(is_escalated) AS "Escalated Cases" count(is_resolved) AS "Resolved Cases" by assigned_to,TeamName,_time| fields - TeamName
0 Karma

udaypulipaka
Observer

But it will display for 1 weak data right. I want to display data for 3 weaks like I send in image.i want dashboard should display like that in image.how can create that dashboard like that

0 Karma

Vijeta
Influencer

you need to use your earliest time as -3w and latest time as now,it will give you each weeks data for that time span.

0 Karma

udaypulipaka
Observer

index="os" sourcetype="Service" CaseNumber= status= assignment=* |dedup _time,CaseNumber,assignment |streamstats current=f last(assignment) as lg, last(active) as Active by CaseNumber|lookup L1Team.csv SS as assigned_to OUTPUT TeamName| eval is_escalated= if(assignment!=lg AND assignment_group="Susta",1,NULL) |eval is_resolved=if(assignment="Susta" AND status="Complete" AND (isnull(Active) OR Active="true"),1,NULL) | bin span=1w _time|stats count(is_escalated) AS "Escalated Cases" count(is_resolved) AS "Resolved Cases" by assigned_to,TeamName,_time| fields - TeamName

I need to create timechart for this.When i give timechart for this query it is not displaying correctly.Please help how to for this with timechart

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...