Hi,
I have two bar charts namely resolved and escalated bar charts .Based on component we created this two charts.Now i want to combine two charts into one chart and place side by side based on component.For example "Data is Not getting" component,Then it should display side by side in chart for resolved and escalated.
Not knowing your search which leads to the shown charts it's a bit hard to come up with the correct search, but you could go like this:
<your base search> | stats count(resolved) as num_resolved count(escalated) as num_escalated by component
and display the results as a bar chart. this should render the results you need.
Not knowing your search which leads to the shown charts it's a bit hard to come up with the correct search, but you could go like this:
<your base search> | stats count(resolved) as num_resolved count(escalated) as num_escalated by component
and display the results as a bar chart. this should render the results you need.
index="os" sourcetype="Service" CaseNumber=* status=* assignment_group=* |dedup _time,CaseNumber,assignment_group| streamstats current=f last(assignment_group) as lg by CaseNumber|where assignment_group!=lg AND assignment_group="Sustaining L1"|chart count as "Escalated Cases" by Component
index="os" sourcetype="Service" CaseNumber=* status=* assignment_group=* |dedup _time,CaseNumber,assignment_group| streamstats current=f last(assignment_group) as lg, last(active) as Active by CaseNumber|where assignment_group="Sustaining L1" AND status="Complete" AND (isnull(Active) OR Active="true")|chart count as "Resolved Cases" by Component
Please give me final Query
Thank u so much for your help.It is working fine.
Try this:
index="os" sourcetype="Service" CaseNumber= status= assignment_group=*
| dedup _time,CaseNumber,assignment_group
| streamstats current=f last(assignment_group) as lg, last(active) as Active by CaseNumber
| eval is_escalated = if(assignment_group!=lg AND assignment_group=="Sustaining L1",1,NULL)
| eval is_resolved = if(assignment_group=="Sustaining L1" AND status=="Complete" AND (isnull(Active) OR Active="true"),1,NULL)
| chart count(is_escalated) AS "Escalated Cases" count(is_resolved) AS "Resolved Cases" by Component