Splunk Search

How to create a bar chart that counts completed tickets and averages

New Member

Hi guys! I am pretty new to this and in researching I have not found what I am looking for or did not recognize the answer when it was in front of me. Anyway, I am trying to create a bar chart that counts how many completed tickets, Average days it too to assign the ticket, Average days to complete the ticket after it was assigned and the Total Average Days per month. So what I am 'trying to do' is have a chart that shows...


Month Completed AvgDaystoAssign AvgDaystoCompleteafterAssign TotalAvgDays
JAN 1 12 10 22
FEB 1 10 10 20
MAR 1 2 2 4
etc etc

Below is what I have done:

| dedup Work_Order_ID 
| eval Days_to_Assign=round((Actual_Start_Date-Submit_Date)/86400,0)
| eval Days_to_Complete_after_Assign=round((Completed_Date-Actual_Start_Date)/86400,0)
| eval Total_Days_from_Submit_to_Completion=round((Completed_Date-Submit_Date)/86400,0) 
| stats count(Status) as Completed, avg(Days_to_Assign) as Avg_Days_to_Assign, avg(Days_to_Complete_after_Assign) as Avg_Days_to_Complete_after_Assign, avg(Total_Days_from_Submit_to_Completion) as Avg_Total_Days_from_Submit_to_Completion by Completed_Date | fieldformat Completed_Date=strftime(Completed_Date,"%b")

What I get is each ticket listed separately by month instead of getting just totals for each month.

I get...ignore the numbers, I just plugged those in for an example
Month Completed AvgDaystoAssign AvgDaystoCompleteafterAssign TotalAvgDays
JAN 1 12 10 22
JAN 1 10 10 20
FEB 1 9 10 19
FEB 1 4 4 8
MAR 1 1 1 2

Any help is greatly appreciated!

0 Karma

New Member

Apologies, I did not copy the entire thing....

| dedup WorkOrderID
| eval DaystoAssign=round((ActualStartDate-SubmitDate)/86400,0)
| eval Days
| eval TotalDaysfromSubmittoCompletion=round((CompletedDate-SubmitDate)/86400,0)
| stats count(Status) AS Completed, avg(Days
toAssign) as AvgDaystoAssign, avg(DaystoCompleteafterAssign) as AvgDaystoCompleteafterAssign, avg(TotalDaysfromSubmittoCompletion) as AvgTotalDaysfromSubmittoCompletion by CompletedDate
| fieldformat Completed

0 Karma

New Member

I came up with this solution...

My Search
| dedup WorkOrderID
| eval AvgDaystoAssign=round((ActualStartDate-SubmitDate)/86400,0)
| eval AvgDaystoCompleteafterAssign=round((CompletedDate-ActualStartDate)/86400,0)
| eval AvgTotalDaysfromSubmittoCompletion=round((CompletedDate-SubmitDate)/86400,0)
| eval Month=strftime(CompletedDate,"%Y-%m (%b)")
| stats count(eval(Status="5")) AS Completed, avg(Avg
DaystoAssign) as AvgDaystoAssign, avg(AvgDaystoCompleteafterAssign) as AvgDaystoCompleteafterAssign, avg(AvgTotalDaysfromSubmittoCompletion) as AvgTotalDaysfromSubmittoCompletion by Month
| eval Avg
| eval Avg
| eval Avg

0 Karma