I'm working on Splunk version 8.2 sourcetype="pqr:task" dv_number="task*" | table dv_number dv_state _time | stats earliest(_time) as _time by dv_number dv_state | eval _time=relative_time(_time,"@d") | xyseries _time dv_number dv_state | makecontinuous _time span=1d | filldown | streamstats values(*) as * window=2 current=t | untable _time dv_number dv_state | eval dv_state=if(dv_state="complete",null(),mvindex(split(dv_state," "),0)) | eval count=1 | eval _time=_time."!".dv_number | xyseries _time dv_state count | fillnull value=0 | eval number=mvindex(split(_time,"!"),1) | eval _time=mvindex(split(_time,"!"),0) | table _time number Draft "Work in progress" Complete | stats sum(Draft) as Draft, sum(Work in progress) as "WIP", sum(Complete) as Complete by _time Reply
... View more