In x axis, I want to show the status (which will be approved/reject/Manual) and on the bar  I have to show the values of Amount for the particular status.  See the attached the sample view.        ... View more

 On y axis, I I am trying show the amount  and in x axis status will be there on the date basis.  Help me out with the mentioned query ... View more

I have to show Amount on barchart. I am not able to show it. pls help us index = pcf_logs cf_org_name = creorg OR cf_org_name = SvcITDnFAppsOrg cf_app_name=VerifyReviewConsumerService host="*" | eval _raw = msg | rex "InputAmountToCredit\"\:\"(?<PayloadAmount>[^\"]+)" | rex field=msg "InputAmountToCredit\"\:\"(?<PayloadAmount>[^\"]+)" | rex field=msg "Request\#\:\s*(?<ID1>\d+) with (?<Status>\w+.\w+)" | rex field=msg "CRERequestId\"\:\"(?<ID2>[^\"]+)" | eval ID=coalesce(ID1,ID2) | stats latest(Status) as Status values(PayloadAmount) as Amount by ID | stats count(list(PayloadAmount)) by Status | eval _time=relative_time(now(),"-1d@d") | timechart usenull=f span=1d count by Status   ... View more

Please look this query and help to show the amount value on barchart index = pcf_logs cf_org_name = creorg OR cf_org_name = SvcITDnFAppsOrg cf_app_name=VerifyReviewConsumerService host="*" | eval _raw = msg | rex "InputAmountToCredit\"\:\"(?<PayloadAmount>[^\"]+)" | rex field=msg "InputAmountToCredit\"\:\"(?<PayloadAmount>[^\"]+)" | rex field=msg "Request\#\:\s*(?<ID1>\d+) with (?<Status>\w+.\w+)" | rex field=msg "CRERequestId\"\:\"(?<ID2>[^\"]+)" | eval ID=coalesce(ID1,ID2) | stats latest(Status) as Status values(PayloadAmount) as Amount by ID | stats count(list(PayloadAmount)) by Status | eval _time=relative_time(now(),"-1d@d") | timechart usenull=f span=1d count by Status   ... View more

I have passed  timechart usenull=f span=1d count by Status after the above query. But I am getting the error as no data found. ... View more