how to make a bar graph showing quantity closed notable events based on last modified time in a time range of 12 hours?

[grotti]

I would like a search query that would display a graph with the number of closed notables divided by urgency in the last 12 hours, but the notables need to be retrieved based on the time they were closed.

I'm using this search:

| inputlookup append=T incident_review_lookup 
| rename user as reviewer 
| `get_realname(owner)` 
| `get_realname(reviewer)` 
| eval nullstatus=if(isnull(status),"true","false") 
| `get_reviewstatuses` 
| eval status=if((isnull(status) OR isnull(status_label)) AND nullstatus=="false",0,status) 
| eval status_label=if(isnull(status_label) AND nullstatus=="false","Unassigned",status_label) 
| eval status_description=if(isnull(status_description) AND nullstatus=="false","unknown",status_description) 
| eval _time=time 
| `uitime(time)` 
| fields - nullstatus

What's wrong?

[meetmshah]

Hello @grotti, If I understand the issue correctly, you are getting the expected results, but not for 12 hours. Is that right? If so, you can use "| addinfo" command as below - 

| inputlookup append=T incident_review_lookup
| addinfo
| where time>=info_min_time
| rename user as reviewer
| `get_realname(owner)`
| `get_realname(reviewer)`
| eval nullstatus=if(isnull(status),"true","false")
| `get_reviewstatuses`
| eval status=if((isnull(status) OR isnull(status_label)) AND nullstatus=="false",0,status)
| eval status_label=if(isnull(status_label) AND nullstatus=="false","Unassigned",status_label)
| eval status_description=if(isnull(status_description) AND nullstatus=="false","unknown",status_description)
| eval _time=time
| fields - nullstatus

It would give you the results based on whatever time range you are selecting from time range picker.

Please accept the solution and hit Karma, if this helps!

[meetmshah]

Hello, Just checking through if the issue was resolved or you have any further questions?