Hi, all.
So, I'm using a timechart visualization (line graph) to display the number of events, by hour, over six weeks and using timewrap to overlay the weeks on top of each other, then showing the last two weeks along with a six week average in order to be able to spot anomalies at a glance. The problem I'm having is if I mouse over a data point from the current week it shows the appropriate date, but it still shows the same date if I mouse over the previous week's data point, too, or the week before that.
For example, if I mouse over 12:00 on Wednesday for "latest_week," the tooltip will show "May 8th, 2024 12:00 PM." If I mouse over 12:00 on Wednesday for "1week_before," the tooltip still shows "May 8th, 2024 12:00 PM."
Is there any way to get the tooltip to show the proper date on the mouse-over? I know that's not going to work on the six week average, but it'd be nice with the current and previous weeks. It's a minor inconvenience, granted, but this is going into a dashboard for not-so-tech-savy customers and if I don't have to make them do math in their head we'll all be a lot better off.
Here's my query, in case it'll help (and feel free to direct me toward something more efficient if I'm doing something stupid, you aren't going to hurt my feelings any):
| tstats count where <my_index> <data_field1> <data_field2> by _time span=1h prestats=t
| timechart span=1h count by <data_field2>
| rename <data_field2> as tot
| timewrap 1w
| addtotals
| eval avg=round((Total/6),0)
| table _time tot_1week_before tot_latest_week avg
| rename avg as "6 Week Average" tot_latest_week as "Current Week" tot_1week_before as "Previous Week"
