Hi niketnilay,
Please find the actual problem below:
With limit=0 in chart , the chart displays all the available values of taken_date in each row by hostname.
The header will have the corresponding taken_date value for each column.
But I would like to display 30 columns (limit=30) . Columns header should be in descending order of taken_date.
Now unlimited columns are displayed from oldest of taken_date to the latest of the taken_date .
Current search with problem:
base search from JSON..
| eval row1=strptime(taken_date,"%b %d %Y %H:%M:%S:%3N%p")
| eval col1=strptime(taken_date,"%b %d %Y %H:%M:%S")
| chart limit=0 values(row1) as date1 by hostname col1
| fillnull value=NULL
So from the below query, i am trying to get 30 days older to latest value of taken_date in chart.
Here the latest of taken_date can be a week old. The 30 days old date can six months old.
The date&time functions which work only on _time and current time(now()) etc, would not work in this context.
In the below query i am expecting the values from 30 days old of taken_date to latest of taken_date.
30 days old date is derived by substracting 30 days from latest of taken_date.
latest of taken_date can be a week old,2 weeks old or any.
base search from JSON..
| eval row1=strptime(taken_date,"%b %d %Y %H:%M:%S:%3N%p")
| eval col1=strptime(taken_date,"%b %d %Y %H:%M:%S")
| stats max(row1) as max_row1 by row1 hostname max(col1) as max_col1 by col1
| eval max_row1_30= max_row1-2629743
| eval max_col1_30= max_col1-2629743
| where row1 > max_row1_30 AND where col1 > max_col1_30
| chart limit=0 values(row1) as date1 by hostname col1
| fillnull value=NULL
Thank you.
... View more