Not able to apply the timechart on mentioned query

[nikhilup05]

eval _raw = msg | rex "InputAmountToCredit\"\:\"(?<PayloadAmount>[^\"]+)" | rex "Request\#\:\s*(?<ID1>\d+) with (?<Status>\w+.\w+)" | rex "CRERequestId\"\:\"(?<ID2>[^\"]+)" | eval ID=coalesce(ID1,ID2) | stats latest(Status) as Status values(PayloadAmount) as Amount by ID| stats count(list()) by Status| eval _time=relative_time(now(),"-1d@d")|

[nikhilup05]

I have passed  timechart usenull=f span=1d count by Status after the above query. But I am getting the error as no data found.

[richgalloway]

This run-anywhere version of your query produces results.

| makeresults 
| eval msg="InputAmountToCredit\":\"23\", Request#: 11 with foo.bar CRERequestId\":\"fubar" 
| rex field=msg "InputAmountToCredit\"\:\"(?<PayloadAmount>[^\"]+)" 
| rex field=msg "Request\#\:\s*(?<ID1>\d+) with (?<Status>\w+.\w+)" 
| rex field=msg "CRERequestId\"\:\"(?<ID2>[^\"]+)" 
| eval ID=coalesce(ID1,ID2) 
| stats latest(Status) as Status values(PayloadAmount) as Amount by ID 
| stats count(list()) by Status 
| eval _time=relative_time(now(),"-1d@d") 
| timechart usenull=f span=1d count by Status

The results are uninteresting, however, because every value has the same timestamp (00:00 yesterday).

Also, what are you trying to achieve with stats count(list())?  The list() function is supposed to have an argument.

Perhaps you could explain the problem you are trying to solve so we can offer better solutions.

[nikhilup05]

I have to show Amount on barchart. I am not able to show it. pls help us

index = pcf_logs cf_org_name = creorg OR cf_org_name = SvcITDnFAppsOrg cf_app_name=VerifyReviewConsumerService host="*"
| eval _raw = msg | rex "InputAmountToCredit\"\:\"(?<PayloadAmount>[^\"]+)"
| rex field=msg "InputAmountToCredit\"\:\"(?<PayloadAmount>[^\"]+)"
| rex field=msg "Request\#\:\s*(?<ID1>\d+) with (?<Status>\w+.\w+)"
| rex field=msg "CRERequestId\"\:\"(?<ID2>[^\"]+)"
| eval ID=coalesce(ID1,ID2)
| stats latest(Status) as Status values(PayloadAmount) as Amount by ID
| stats count(list(PayloadAmount)) by Status
| eval _time=relative_time(now(),"-1d@d")
| timechart usenull=f span=1d count by Status

[richgalloway]

So you want Amount as one axis of the bar chart.  What should the other axis be?  Once we know that we can devise a query to produce the right information.  As it is now, the query seems to be doing a lot more work than is necessary.

[nikhilup05]

 On y axis, I I am trying show the amount  and in x axis status will be there on the date basis. 

Help me out with the mentioned query

[richgalloway]

I'm still confused.  The x-axis will have "status on the date basis".  What does that mean?

[nikhilup05]

In x axis, I want to show the status (which will be approved/reject/Manual) and on the bar  I have to show the values of Amount for the particular status.  See the attached the sample view. 

[richgalloway]

Thanks for the clarifying charts.

Since each axis of a chart can use only one field, you will have to combine the date and Status fields into a single field before charting.

... | eval x_axis = date . " " . Status
| chart max(Amount) as Amount over x_axis

[nikhilup05]

Please look this query and help to show the amount value on barchart

index = pcf_logs cf_org_name = creorg OR cf_org_name = SvcITDnFAppsOrg cf_app_name=VerifyReviewConsumerService host="*"
| eval _raw = msg | rex "InputAmountToCredit\"\:\"(?<PayloadAmount>[^\"]+)"
| rex field=msg "InputAmountToCredit\"\:\"(?<PayloadAmount>[^\"]+)"
| rex field=msg "Request\#\:\s*(?<ID1>\d+) with (?<Status>\w+.\w+)"
| rex field=msg "CRERequestId\"\:\"(?<ID2>[^\"]+)"
| eval ID=coalesce(ID1,ID2)
| stats latest(Status) as Status values(PayloadAmount) as Amount by ID
| stats count(list(PayloadAmount)) by Status
| eval _time=relative_time(now(),"-1d@d")
| timechart usenull=f span=1d count by Status

[richgalloway]

What is preventing you from applying a timechart?  How have you tried to do so?  What error do you get when you try?