@ITWhisperer wrote: Your issue there is that your x-axis is _time - charts treat _time in special ways - one way around this would be to assign a new field to a formatted version of time   | bin _time span=7d | eval time=strftime(_time,"%y-%m-%d") | chart sum(MIPS) over time by EXPRSSN   I tried spanning for 7d and it showed differently.  I wanted to span it still per day but wanted to display weeks on the x-axis instead of months.   ... View more

Hi,    Thank you. This worked for the Y-axis display. Would you know how I can update the X-axis interval also? Thanks and Regards, ... View more

Hi,  It will be this one. <dashboard> <label>13MONTH</label> <row> <panel> <title>13 MONTH WEEKLY CPU AVERAGE AND HIGH WATER MARK WITH WEEKLY AVERAGE TREND</title> <chart> <title>IBM4D</title> <search> <query>index=xxxxxx sourcetype="xxxxxx" EXPRSSN=IBM4D* | eval DATE=strftime(strptime(DATE,"%d%b%Y"),"%Y-%m-%d") | table EXPRSSN DATE MIPS | eval _time=strptime(DATE." "."00:00:00","%Y-%m-%d %H:%M:%S") | chart list(MIPS) over _time by EXPRSSN | trendline sma2(MIPS) as trend</query> <earliest>0</earliest> <latest></latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisLabelsY.majorUnit">500</option> <option name="charting.axisTitleX.visibility">collapsed</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.abbreviation">none</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.abbreviation">none</option> <option name="charting.axisY.maximumNumber">6000</option> <option name="charting.axisY.minimumNumber">0</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.abbreviation">none</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">area</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.overlayFields">IBM4DPEAK</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">none</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisStart</option> <option name="charting.legend.mode">standard</option> <option name="charting.legend.placement">bottom</option> <option name="charting.lineWidth">2</option> <option name="refresh.display">progressbar</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> </chart> </panel> </row> </dashboard>   Thanks and Regards, ... View more

Hi, I tried it but didn't really changed the visual much. Thanks and Regards, ... View more

Hi, Thanks for the idea. I'll test this one. Regards, ... View more

Hi, Thank you very much for the response and support. I have learned a lot from your answers.   ... View more

It's look like there is an issue with the input itself so it is not being converted properly. Thanks for the help! ... View more

Hi, Here is my full search. index=index1 sourcetype=sourcertype1 MVS_SYSTEM_ID != MVS_SYSTEM_ID | multikv forceheader=1 | dedup ACCOUNT_CODE DATE MVS_SYSTEM_ID CALCMIPS | eval DATE=strftime(strptime(DATE,"%d%b%Y"),"%Y-%m-%d") | lookup lookup.csv ACCOUNT_CODE OUTPUT Application BusinessUnit ApplicationRTO | eval Application=(if (isnull(Application),"Others",Application)) | eval BusinessUnit=(if (isnull(BusinessUnit),"Others",BusinessUnit)) | eval HOUR=if (isnull(HOUR),"0",HOUR) | eval eventHour=substr("0".HOUR,-2,2).":00:00" | eval _time=strptime(DATE." ".eventHour,"%Y-%m-%d %H:%M:%S") | table Application BusinessUnit DATE SYSTEM_ID CALCMIPS eventHour _time | chart avg(CALCMIPS) over _time span=1mon by BusinessUnit limit=0 Thanks ! ... View more

Hi, Sorry but what do you mean by multivalue?  The DATE from our input is formatted as 01JAN2021 so I used eval DATE=strftime(strptime(DATE,"%d%b%Y"),"%Y-%m-%d") to reformat it. ... View more

Thank you. But would you know why I am getting this as _time result?   ... View more

Thanks! Although I used eval and isnull funtion since there are other fields in the table that might contain null values as well. ... View more

Hello @ITWhisperer , Thank you for the great assistance. We are currently on build 7.3. I wanted to update the look of the table like the font and color so that users would be able to see it better.   Thanks and Regards, ... View more

Thank you the idea. I noticed that I cannot use the expand based on the chart legend so I made a list instead to use the drilldown. ... View more

Hi, Apologies if I didn't made myself clear but I was able to filter my lookup properly now after fixing my logic. Thanks! ... View more