I cannot share the log as it contains a lot of confidential information. I don't think it's necessary anyway as you can see that I'm able to get a proper table with data before the timechart. If I add make _time in my query I just get the following: Unknown search command 'make'. So, going back to my previous question - maybe someone else in this forum can help: This is my current query: | eval start_time_epoch = strptime(reported_time,"%b %d %Y %H:%M:%S")
| eval start_time_second = strftime(start_time_epoch,"%S")
| eval start_time_epoch_rounded = start_time_epoch - start_time_second - 5*3600
| fields - start_time_epoch, start_time_second
| eval close_time_epoch = strptime(processed_time,"%b %d %Y %H:%M:%S")
| eval close_time_second = strftime(close_time_epoch,"%S")
| eval close_time_epoch_rounded = close_time_epoch - close_time_second - 5*3600
| fields - close_time_epoch, close_time_second
| eval minute = mvrange(0, (close_time_epoch_rounded - start_time_epoch_rounded), 60)
| mvexpand minute
| eval _time = start_time_epoch_rounded + minute
| eval myHour = strftime(_time,"%H")
| eval myMinute = strftime(_time,"%M")
| eval myDay = strftime(_time,"%A")
| where myDay != "Saturday" AND myDay != "Sunday" AND (myHour >= 8 AND myHour < 20)
| eval ReportedTime = strftime(start_time_epoch_rounded,"%b %d %Y %H:%M:%S")
| eval ProcessedTime = strftime(close_time_epoch_rounded,"%b %d %Y %H:%M:%S")
| stats count as durationInMinutes by ticket,ReportedTime,ProcessedTime
| stats count as Total count(eval(durationInMinutes<60)) as Achieved by ProcessedTime
| timechart count(round(Achieved*100/Total, 2)) If I run that, there are events but I don't get a visualization. The issue in this post is to get the Timeline working! If I remove the timeline line I can get good data: ProcessedTime Total Achieved
Jul 13 2020 07:01:00 3 0
Jul 13 2020 07:03:00 2 0
Jul 13 2020 07:04:00 2 1
Jul 13 2020 07:11:00 2 1 I have time (ProcessedTime), I have values for Achieved. I have values for Total. Can anyone else help? Thank you
... View more
