I have a set of data that has a data field inside that shows when an asset has been assigned. Right now, we're pulling the total count of those assets, but have been asked to show an incrementing count over the course of a line chart.
The data looks something like this:
Asset ID | Assigned Date |
123 | 7/12/21 |
124 | 7/12/21 |
125 | 7/13/21 |
126 | 7/14/21 |
I want the data in the chart to show like this:
Essentially, after each date from the start, the chart adds the previous dates, and charts the total.
Thanks in advance.
Can you please try this?
YOUR_SEARCH
| streamstats count
| eventstats max(count) as m by Assigned_Date | where count=m
| table Assigned_Date count
My Sample Search :
| makeresults | eval _raw = "Asset ID Assigned Date
123 7/12/21
124 7/12/21
125 7/13/21
1254 7/13/21
126 7/14/21"| multikv forceheader=1
| table Asset_ID Assigned_Date
| rename comment as "Upto Now is sample data only"
| streamstats count
| eventstats max(count) as m by Assigned_Date | where count=m
| table Assigned_Date count
Thanks
KV
▄︻̷̿┻̿═━一 ?
If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.
| streamstats dc(AssetID) by AssignedDate
Can you please try this?
YOUR_SEARCH
| streamstats count
| eventstats max(count) as m by Assigned_Date | where count=m
| table Assigned_Date count
My Sample Search :
| makeresults | eval _raw = "Asset ID Assigned Date
123 7/12/21
124 7/12/21
125 7/13/21
1254 7/13/21
126 7/14/21"| multikv forceheader=1
| table Asset_ID Assigned_Date
| rename comment as "Upto Now is sample data only"
| streamstats count
| eventstats max(count) as m by Assigned_Date | where count=m
| table Assigned_Date count
Thanks
KV
▄︻̷̿┻̿═━一 ?
If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.
Changed it a bit to fit our actual fields, but this got us there! Thanks a bunch!