Hi ,
I have a query where I am trying to use Chart funtion to show for a particular application which have multiple versions of the same application installed show number of PC's that particular application got installed with InstallDate field under X-Axis and Y Axis shows the numbers
I am able to acheive it .. But I do not want the field which is in my X-Axis to show fr all the dates, instead it should show in 3 days period like example: X-axis should say 1march, 4march, 7th march and y-axis should say overall sum of the installed count of pc's per application version
|chart count(host) as #Hosts over InstallDate by DisplayVersion
Here InstallDate is my x-axis fields..
hi
try like
| eval _time= InstallDate | timechart count(host) as #Hosts span=3d by DisplayVersion
if InstallDate is not in epoch convert it and give a try
It worked to get me that difference like date shows in 3 days gap.. but data under each displayVersion is 0.