Hi
I am trying to create a comparative trend chart for Today and yesterday, but i have problem with the visualization. i need to make sure all the Today data have one color and all the Yesterday have another color. So the table would look like:
_time Today:XXXX Today:XXXX Yesterday:XXXX Yesterday:XXXX
10:05 25 30 25 22
10:10 22 23 22 24
10:15 10 12 11 13
Here XXXX-> represent integers (they aren't static and generate new numbers every 5 mins)
Hi Venkat_16
If you are sure that the query above is yours then copy and paste the following xml code in a view and test
<dashboard>
<label>enter something</label>
<input type="time" token="time_tok" searchWhenChanged="true">
<label></label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
<row>
<chart>
<title>Field colors example</title>
<search>
<query>
index=XXXX sourcetype=XXXX earliest=@d latest=now |bin span=5m _time|stats count(XID) as thisDay by ID |append [search index=os sourcetype=sysstat_proc host="apapnp05" earliest=-1d@d latest=@d |bin span=5m _time|stats count(XID) as LastDay by ID | eval new_time=_time+86400] | |eval _time=if(isnotnull(new_time), new_time,_time)|timechart span=5m sum(thisDay) as Today sum(LastDay) as Yesterday by ID
</query>
<earliest>$time_tok.earliest$</earliest>
<latest>$time_tok.latest$</latest>
</search>
<option name="charting.axisY.scale">log</option>
<option name="charting.chart">column</option>
<option name="charting.fieldColors">
{"thisDay ": 0xFF0000, "LastDay ": 0xFF9900, "Today":0x0066FF, "Yesterday":0xC4C4C0 ,"NULL":0xC4EFC0}
</option>
<option name="charting.legend.placement">right</option>
</chart>
</row>
</dashboard>
Hi Venkat_16
have you test the xml code above ? If no let test and see
Hello! Lets get the search you are using to build your table?
index=XXXX sourcetype=XXXX earliest=@d latest=now |bin span=5m _time|stats count(XID) as thisDay by ID |append [search index=os sourcetype=sysstat_proc host="apapnp05" earliest=-1d@d latest=@d |bin span=5m _time|stats count(XID) as LastDay by ID | eval new_time=_time+86400] | |eval _time=if(isnotnull(new_time), new_time,_time)|timechart span=5m sum(thisDay) as Today sum(LastDay) as Yesterday by ID
Are you sure your query is the one giving the table above? Please let me get some of your ID's values.
Thanks