How to create dashboard with Multiple values for a month on x axis?

[shahbaz]

Hi, 

I have Json data for github repos in below format 

{ 
   data: { [-]
     clone_count: 0
     clone_uniques: 0
     view_count: 7
     view_uniques: 4
   }
   date: 2022-06-28
   repository: projectA
}

this data will be pushed every day for 2 repos , now i want to create a dashboard  which has month on x-axis that shows data of sum(clone_count) sum(view_count) for both 2 repos monthly as shown below 

my query is looking like this 

index=test  source="data" | where repository in ("binary","manifest")
| eval data_date = split(date,"-") | eval data_year=mvindex(data_date,0) | eval data_month=mvindex(data_date,1) | eval current_year=strftime(now(),"%Y")|eval current_month=strftime(now(),"%m")|  spath output=clonecount path=data.clone_count  |spath output=viewcount path=data.view_count | stats  sum(clonecount) as Totalclonecount  ,sum(viewcount) AS Totalviewcount  by repository,data_month

[isoutamo]

Hi

you could try something like this

index=_audit | head 1  
| eval _raw = "{\"data\":{\"clone_count\":0,\"clone_uniques\":0,\"view_count\":7,\"view_uniques\":4},\"date\":\"2022-05-27\",\"repository\":\"projectA\"}|{\"data\":{\"clone_count\":0,\"clone_uniques\":0,\"view_count\":7,\"view_uniques\":4},\"date\":\"2022-05-27\",\"repository\":\"projectB\"}|{\"data\":{\"clone_count\":0,\"clone_uniques\":0,\"view_count\":7,\"view_uniques\":4},\"date\":\"2022-06-28\",\"repository\":\"projectA\"}|{\"data\":{\"clone_count\":0,\"clone_uniques\":0,\"view_count\":7,\"view_uniques\":4},\"date\":\"2022-06-28\",\"repository\":\"projectB\"}"
| eval foo = split(_raw,"|")
| mvexpand foo
| eval _raw = foo
```prepare sample data```
| spath
| rename data.* as *
| eval _time = strptime(date, "%Y-%m-%d")
| timechart span=1mon sum(clone_count) as Total_clone_count sum(view_count) as Total_view_count by repository

If you can change your ingestion phase so that you could use json's date as _time you can drop "eval _time ..." part away.

r. Ismo