How to display trend for 3 months?

[udaypulipaka]

Hi,

How can i display last 3 months data monthly wise count as trend dashboard.To check whether monthly increasing or decreaing data.

index="os" sourcetype="Service" CaseNumber=* status=* assignment=* |dedup _time,CaseNumber,assignment_group| streamstats current=f last(assignment_group) as lg, last(active) as Active by CaseNumber | eval ss=case(assignment!=lg AND assignment="Susta","Escalated",assignment="Susta" AND status="Complete" AND (isnull(Active) OR Active="true"),"Resolved") |timechart count by ss usenull=f

How can i display monthly wise count as trend in dashboard

[vinod94 · Accepted solution]

@udaypulipaka ,

Please accept the answer if it worked for you!.

[vinod94]

Try this,

You can use span in timechart

https://docs.splunk.com/Documentation/SplunkCloud/7.2.3/SearchReference/Timechart

Your search |  timechart  span=3mon count by ss usenull=f

[udaypulipaka]

index="os" sourcetype="Service" CaseNumber=* status=* assignment=* |dedup _time,CaseNumber,assignment|streamstats current=f last(assignment) as lg, last(active) as Active by CaseNumber | eval is_escalated= if(assignment!=lg AND assignment="Susta",1,NULL)
|eval is_resolved=if(assignment_group="Susta" AND status="Complete" AND (isnull(Active) OR Active="true"),1,NULL)| chart count(is_escalated) AS "Escalated Cases" count(is_resolved) AS "Resolved Cases" by Component

For this query i need linechart.when i add timechart to this query it is showing all the components in below.It looks not gud.So can u help how to do trend for this query.

[vinod94]

can you try this,

your search |  bin span=3mon _time |stats count(ss) as count by _time

[udaypulipaka]

timechart span=3mon count by ss usenull=f this is working fine.Thank u for your help