Help needed Timechart Query

[Macky_29]

Dear experts , 

I am searching on my bot index, which contain conve-id and rest of the fields are stored as payload. Using spath i am able to extract required fields from payload into a table , now for trend analysis i want to use time chart command to see number of users per month , however its not working , below is the query for your reference , need help with the query :

index=idx_chatbot logpoint=response-in AND service="journeyService" OR service="watsonPostMessage"
|spath input=payload output=displayname path=context.displayName 
| spath input=payload output=Country path=context.countryCode 
| spath input=payload output=Intent path=intents{}.intent 
|spath input=payload output=ticketResponse 
       path=response.createTicketResponse.Message 
| table conversation-id timestamp service duration logpoint userFeedback displayname text Country Intent category ticketResponse payload
| dedup conversation-id
| timechart span=1mon count(displayName) 

[Macky_29]

[richgalloway]

"Its not working" gives us nothing to work with.  Help us help you by explaining what the expected results are and what you are getting from the current query.

[Macky_29]

@richgalloway 

It doesn't give any result , below is the screenshot

I am expecting it gives me monthly count (trend)of distinct display name i.e. users in my case.

[bowesmana · Accepted solution]

You can't do a timechart without the _time field and your table command effectively removes the _time field

Also, not sure why your timechart is count(displayName) as that is counting occurrences of that field in all the deduped conversation-id events - so unless it is blank in some events, it will be a 1:1 relationship with conversation-id. 

It would seem that you are looking to count the number of individual conversations, so you would get this by replacing your last 3 lines with

| timechart span=1mon dc(conversation-id)

but if you are looking for distinct displayName then you can still replace the last 3 lines with

| timechart span=1mon dc(displayName)

 unless you have have many _different_ displayName values for a single conversation-id

[Macky_29]

Thanks Bowesmana it works 😊