Hi,
I have a bar chart with 4 values. I would like to stack them by 1 field.
example:
The code I am using:
index=snow assignment_group_name=*israel* (dv_state="Ope*" OR dv_state="Clos*") (priority=2 OR priority=4)
| dedup number
| eval newTime = strftime(_time,"%Y-%m-%d")
| eval year = substr(substr(newTime,3,4),1,2)
| eval month = substr(substr(newTime,6,7),1,2)
| eval realDate = year+"."+month
| eval monthCreated = substr(substr(sys_created_on,6,7),1,2)
| eval yearCreated = substr(substr(sys_created_on,3,4),1,2)
| eval dateCreated = yearCreated+"."+monthCreated
| where tonumber(substr(dateCreated,1,2)) > 16
| replace "Closed Complete" with Closed "Closed Incomplete" with Closed "Closed Skipped" with Closed "Pending Customer" with Pending in dv_state
| replace 4 with Normal 2 with High in priority
| table number realDate dateCreated dv_state priority _time
| chart count(eval(realDate==dateCreated)) as Opened count(eval(dv_state=="Closed")) as Closed over realDate by priority
Photo of the result with the current code:
If I choose the stacked option it stacks all 4 options (in legend). I want to stack them only by priority field so that the result will be similar to this:
Is it possible?
Thank you
... View more