Dashboards & Visualizations

graph details

DTERM
Contributor

index=MyApp earliest=-30d@d-14h | where (date_hour>=10 AND date_hour<22) | bucket _time span=1d | stats count by _time | sort - _time | append [ search index=MyApp earliest=-30d@d-2h | where(date_hour<10 or date_hour>=22) | eval _time=if(date_hour<10, _time-86400, _time) | bucket _time span=1d | stats count by _time | sort - _time]

I'm using the query above to generate a graph of the number of tickets for two different support staff shifts. One shift is from 10:00 AM through 10:00 PM. The other shift is from 10:00 PM to 10:00 AM. Ultimately, I want two line graphs of the number of tickets each staff gets (to compare against each other).

The graph however is not helpful. Is there a way that I can provide different colors for the lines? Also, the legend has a single entry - "Count". Is there a way to modify or change the legend? Finally, there appears to be a third line (I'm guessing an average??) that appears as well. I don't want that.

Thanks in advance.

Tags (1)
0 Karma
1 Solution

fk319
Builder

First, when you do a 'stats' you can use the as option, 'stats count as "DayShift" by _time'.


I am thinking that I would redo your query a bit.

index=MyApp earliest=-30d@d-14h | eval Shift=if(10<=date_hour and date_hour<22,"Day","Night") | timechart span=1d count by Shift

View solution in original post

fk319
Builder

First, when you do a 'stats' you can use the as option, 'stats count as "DayShift" by _time'.


I am thinking that I would redo your query a bit.

index=MyApp earliest=-30d@d-14h | eval Shift=if(10<=date_hour and date_hour<22,"Day","Night") | timechart span=1d count by Shift

DTERM
Contributor

That is perfect. Thanks.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...