Creating a pie chart or any visualization show last 6 months and 12 month?

[Keerthi]

Hi All,

This is the existing visualization which has Lastlogon(people who haven't logged in for quiet sometime). Those record which has null lastlogon value is done a count. I have requirement here to show value for last 6 month and 12 months. Can anyone help me in providing the command for last 6 months and 12 months

[Keerthi]

How to show both last 6 and last 12 months together in a single visualization?

[ITWhisperer]

Just set a field with a value which represents which time segment it comes from and use that in your visualisation.

[Keerthi]

 you explain with an example for the command please

[ITWhisperer · Accepted solution]

| eval period=case(_time > relative_time(_time,"-6mon@d"),"6months",_time > relative_time(_time,"-1y@d"),"12months") 

[ITWhisperer]

Just extend your timeframe for your search to 6 months, then 12 months - assuming you have the data going back that far!