timechart sum the total results of a query and have individual values too.

[jperezes]

Hi and thanks in advance,

I am trying to get a dashboard to get the total number of calls, the call types and the users who placed the calls

if I count by callType I get each call type then I pipe by addtotals, so I get the first two stats, but how then I can do something like dc(filterUserName)

| timechart span 1d count by typeOfCall | addtotals | dc(userNames)

last dc(userNAmes) returns an error.

thx,

Juan

[somesoni2]

Try something like this

your base search | timechart span=1d count dc(userNames) as Users by typeOfCall | addcoltotals

This should give you distinct user count for each day by each typeOfCall.

[Richfez]

Try this:

... | bin span=1d | stats dc(userNames) as DistinctUserCount count as OverallCount by typeOfCall | addtotals 

I've rearrange things a bit to ...
Drop things into bins of 1d each.
Create some statistics, like the one you want - there are lots more to do if you want.
Then do your addtotals and whatnot.

Note you didn't use the "code" button to format that, so I only hope it all came through. (It looks like a fine search, so it probably did)

[jperezes]

Hi rich7177,

Thanks for your quick response I tried your command and I got the error bin need a field to discretize, so I added ... | bin _time span=1d|....

The issue I face with this solution is the addtotals at the end adds different fields like typeOfCall with DistinctUserCount to the total metric. I would need to sum only the total calls placed.

Kind Regards,
Juan

[Richfez]

Oh, good catch, sorry to have forgotten _time in there...

If you only need addtotals to add certain fields, just specify them. In the example case I wrote, that would be
... | addtotals OverallCount