Hello,
I am trying to compare two time windows in the same index but I would like the chart comparing them to be based on a specified name of those time ranges rather than on time.
For example:
Release_A = October 2nd
Release_B = September 20th
(index=.... url=* earliest="10/02/2019:00:00:00" latest="10/02/2019:23:59:59") OR (index=... url=* earliest="09/20/2019:00:00:00" latest="09/20/2019:23:59:59")
| chart avg(seconds) by _time span=1d
I want the chart x-axis values to be Release_A and Release_B rather than a timeline.
Any advice on how to do this would be very appreciated.
try this:
(index=.... url= earliest="10/02/2019:00:00:00" latest="10/02/2019:23:59:59") OR (index=... url= earliest="09/20/2019:00:00:00" latest="09/20/2019:23:59:59")
| chart avg(seconds) by _time span=1d
| convert ctime(_time) timeformat="%B %d"
OR
(index=.... url= earliest="10/02/2019:00:00:00" latest="10/02/2019:23:59:59") OR (index=... url= earliest="09/20/2019:00:00:00" latest="09/20/2019:23:59:59")
| eval time=case(date_mday="2","Release_A",date_mday="20","Release_B")
| chart avg(seconds) by time
try this:
(index=.... url= earliest="10/02/2019:00:00:00" latest="10/02/2019:23:59:59") OR (index=... url= earliest="09/20/2019:00:00:00" latest="09/20/2019:23:59:59")
| chart avg(seconds) by _time span=1d
| convert ctime(_time) timeformat="%B %d"
OR
(index=.... url= earliest="10/02/2019:00:00:00" latest="10/02/2019:23:59:59") OR (index=... url= earliest="09/20/2019:00:00:00" latest="09/20/2019:23:59:59")
| eval time=case(date_mday="2","Release_A",date_mday="20","Release_B")
| chart avg(seconds) by time
That helped a lot and I will definitely be using that eval-case command in the future.
Thank you!
(index=.... url= earliest="10/02/2019:00:00:00" latest="10/03/2019:00:00:00") OR (index=... url= earliest="09/20/2019:00:00:00" latest="09/21/2019:00:00:00")
| timechart avg(seconds) span=1d
Hi, try timechart