Chart Split in N days span

[sandeepshah81]

Hi ,

I have a query where I am trying to use Chart funtion to show for a particular application which have multiple versions of the same application installed show number of PC's that particular application got installed with InstallDate field under X-Axis and Y Axis shows the numbers

I am able to acheive it .. But I do not want the field which is in my X-Axis to show fr all the dates, instead it should show in 3 days period like example: X-axis should say 1march, 4march, 7th march and y-axis should say overall sum of the installed count of pc's per application version

|chart count(host) as #Hosts over InstallDate by DisplayVersion

Here InstallDate is my x-axis fields..

[vnravikumar]

hi
try like

| eval _time= InstallDate | timechart count(host) as #Hosts span=3d by DisplayVersion

[vnravikumar]

if InstallDate is not in epoch convert it and give a try

[sandeepshah81]

It worked to get me that difference like date shows in 3 days gap.. but data under each displayVersion is 0.