Displaying the multiple fields on X-axis of chart. Below is my current search:
index=home | eval Value=substr(Name,-1) |stats count(eval(Value=="A")) AS AValue,count(eval(Status=="B")) AS BValue,count(eval(Value=="C")) AS CValue| Eval DValue= AValue-BValue | chart max(Complete),max(Received),max(Acknowledged),max(Missing)
I want to display a Column chart having AValue, BValue, CValue & DValue on the X-Axis displaying the count of each. Right now this chart command is not working for me.
Thanks
Try like this
index=home | eval Value=substr(Name,-1) | eval temp=1 | chart count over temp by Value | eval Missing=A-B | rename A as Received B as Complete C as Acknowledged | table Complete Received Acknowledged Missing
Try this
index=home
| eval Value=substr(Name,-1)
| eval status=case(Value="A", "AValue", Status="B", "BValue", Value="C", "CValue", 1=1, "Missing")
| stats count by status
| eval DValue=AValue-BValue
I tried this, but after stats command it doesn't show the Missing count in it.