How to get the timings on barchart using chart?

[fahimparvez02]

Please help me to show the timings on below barchart, i am using chart count over by description to view the file name on graph when i point the mouse pointer to chart, but i couldn't able to provide the timings on xaxis , below are the query and graph

index=xxxxx sourcetype = xxxx source="xxxxxx_*.log" |eval description=case(Suspend Like "S","Suspended",Suspend Like "P","Partially-Completed",Suspend Like "C","Completed")|eval File_Name= description."-".TC_File_Name|table _time File_Name TC_File_Name description |chart count(File_Name) over TC_File_Name by description

[ITWhisperer]

The chart will use 3 things to display, the x-axis, the y-axis and the series. In your case, the x-axis is the TC_File_Name, the series are the descriptions, and the y-axis is the count of combinations of descriptions and TC_File_Name, for each TC_File_Name. Time does not figure in any of these. Therefore, with your current search, you will not be able to show time. Which of the dimensions do you want to remove so that time can be shown?

[fahimparvez02]

Thanks for your input, i tried to change as you said but is it possible to  display the field Suspended-TC57* with red color ? please help me on that

index= XXXX source="*.log" | eval description=case(Suspend Like "S","Suspended",Suspend Like "C","Completed",Suspend Like "P","Partially-Completed")|eval newField= description."-".TC57_File_Name|timechart span=1h useother=f limit=0 count by newField|sort by newField.

for the below question, i am trying to display the file name with status on it when we point the mouse over the bar,  also i need to display the timings on xaxis, please help me with either one of the above or below dashboard which ever works would be highly appreciated.

[fahimparvez02]

Can anyone please help on this?

[matt8679]

Hi,

Click Format > Chart Overlay > in overlay, click and select field > View as Axis "On"

That might give you want you want.