Creating a bar chart with multiple fields

[andrwbn]

I am trying to create a bar chart displaying the amount of active users the past 1 hour, 24 hour, and 1 week.

How would I go about doing this?

Thanks!

[gokadroid · Accepted solution]

If you have the keywords to detect and filter out unique active users then you can follow below approach assuming field user identifies a user:

index= yourIndex earliest=-1h your query to return active user
| dedup user
| stats count as ActiveUser
| eval reportKey="Last1Hour"
| append [ search  index= yourIndex earliest=-24h your query to return active user
| dedup user
| stats count as ActiveUser
| eval reportKey="Last24Hour" ]
| append [ search index= yourIndex earliest=-7d your query to return active user
| dedup user
| stats count as ActiveUser
| eval reportKey="Last1Week" ]
| chart ActiveUser over reportKey

[somesoni2]

Give this a try

Updated
Thanks @gokadroid for pointing out the flaw in the previous answer.

your base search earliest=-7d| eval Period=case(_time>=relative_time(now(),"-1h"),"1#Last 1 Hour"),_time>=relative_time(now(),"-24h"),"2#Last 24 Hour",1=1,"3#Last 1 Week") | stats count(UserField) as active_users by Period
| accum active_users | eval Period=mvindex(split(Period,"#"),1)

[gokadroid]

Should not the last one hour users be also part of last 24 hours? and so shall be the last 24 hours part of last 7days? Just thinking!