Hi all,
I am having two fields as eventfield2and eventfield3with values of eventfield3= LHCP , RHCP ,LHCP & values of eventfield2= RHCP , RHCP ,LHCP . I want a result like as shown .
Thanks for your time in advance.
Hi @siva_kumar0147,
The simplest solution is to use the Timeline visualization. You'll need to calculation durations in milliseconds between transitions:
| makeresults format=csv data="_time,direction,polarization
1732782870,TX,L
1732782870,RX,R
1732781700,TX,R
1732781700,RX,L"
| sort 0 - _time + direction
| eval polarization=case(polarization=="L", "LHCP", polarization=="R", "RHCP")
| streamstats global=f window=2 first(_time) as end_time by direction
| addinfo
| eval duration=if(end_time==_time, 1000*(info_max_time-_time), 1000*(end_time-_time))
| table _time direction polarization duration
@tscroggins Thanks for your answer and spending your time, even if we use makeresults , at every point we need to mention that CSV data ?
Hi @siva_kumar0147,
No, I only use makeresults to generate sample data. The logic from the sort command down drives the visualization.
Charts have numeric scales for the y-axis except things like bubble charts but then the values are numeric so it is unlikely that you can get a chart as you proposed - what are you trying to show (there may be alternative ways of representing the data)
@ITWhisperer thanks for your time , we can replace L & R values with some number like L as 9 and R as 10
, then we can make it visualise.