How to edit my search to chart counts and a calculated count, order the bars, apply better labels, and graph values over time?

[elumpkin_caisgr]

I've found a way to chart event counts by eventtype, plus a calculated total of implied events. However, it's a little clunky and I'm wondering if there is a better way to accomplish the same thing. What I have is...

eventtype=enrollment OR eventtype=map-existing-user OR eventtype=start-registration OR eventtype="map-existing-failure"| stats count(eval(eventtype="start-registration")) as regs count(eval(eventtype="map-existing-user")) as existSuccess count(eval(eventtype="enrollment")) as newSuccess count(eval(eventtype="map-existing-failure")) as existFail  | eval abandon=regs-(existSuccess+existFail+newSuccess)| table Events, existSuccess , newSuccess , existFail, abandon

I like that the 3 eventtype counts are bars in the graph, as well as 'abandon' being a bar in the graph. That is the goal. However, I don't like that I can't control the order of the bars, that I can't apply better labels (e.g. 'New Enrollments' instead of newSuccess), and that I can't graph the values over time. Any recommendations on how to accomplish any/all of those would be greatly appreciated.

[woodcock · Accepted solution]

This is better:

eventtype=enrollment OR eventtype=map-existing-user OR eventtype=start-registration OR eventtype="map-existing-failure"
| stats count by eventtype | eval Total="Totals" | xyseries Total eventtype count
| rename "start-registration"  AS regs "map-existing-user" AS existSuccess "enrollment" AS newSuccess "map-existing-failure" AS existFail
| eval abandon=regs-(existSuccess+existFail+newSuccess)| table Events, existSuccess , newSuccess , existFail, abandon

[elumpkin_caisgr]

This more explicitly defines what is being charted and allows me to set the label values. Thank you woodcock!

I would love to find a way to chart the calculated value, but I won't hold my breath.