this is my query and i want to show line graph of CBP vs NonCBP with percentages  Please advise how can achieve it | savedsearch cbp_inc_base | eval _time=strftime(opened_time, "%Y/%m/%d") | bin _time span=1d | chart count(incident_number) as IncidentCount over _time by hasAppBlueprints | eval CBP = round (100*CBP/6737, 2)."%" | eval NonCBP = round(100*NonCBP/12879, 2)."%"   Saved serach is  index="88292-cbp" source_name=**** platformName=REDHAT earliest=-24h | table hostName, source_name, hasAppBlueprints | rename hostName as hostname | join type=inner max=0 hostname [ search index=88292-cgr source_name=*****   earliest=-21d | dedup incident_number | rex field=transfer_description "found as (?<correct_host>[a-zA-Z0-9\-]+) " | rename configuration_item as hostname | eval opened_time=strptime(opened_time, "%b %d, %Y %H:%M:%S") | where (opened_time <= relative_time(now(),"@d")) AND (opened_time >= relative_time(now(),"-30d@d")) | table hostname, alert_id, incident_number, correct_host, opened_time, state | eval hostname=case(match(hostname, ".* .*"), correct_host, 1==1, hostname) ] | eval hasAppBlueprints=if(hasAppBlueprints="true","CBP",hasAppBlueprints) | eval hasAppBlueprints=if(hasAppBlueprints="false","NonCBP",hasAppBlueprints) | table hostname, alert_id, incident_number, source_name, opened_time, hasAppBlueprints, state ... View more

this is my query and i want to show line graph of CBP vs NonCBP with percentages  Please advise how can achieve it | savedsearch cbp_inc_base | eval _time=strftime(opened_time, "%Y/%m/%d") | bin _time span=1d | chart count(incident_number) as IncidentCount over _time by hasAppBlueprints | eval CBP = round (100*CBP/6737, 2)."%" | eval NonCBP = round(100*NonCBP/12879, 2)."%"   Saved serach is  index="88292-cbp" source_name=**** platformName=REDHAT earliest=-24h | table hostName, source_name, hasAppBlueprints | rename hostName as hostname | join type=inner max=0 hostname [ search index=88292-cgr source_name=*****   earliest=-21d | dedup incident_number | rex field=transfer_description "found as (?<correct_host>[a-zA-Z0-9\-]+) " | rename configuration_item as hostname | eval opened_time=strptime(opened_time, "%b %d, %Y %H:%M:%S") | where (opened_time <= relative_time(now(),"@d")) AND (opened_time >= relative_time(now(),"-30d@d")) | table hostname, alert_id, incident_number, correct_host, opened_time, state | eval hostname=case(match(hostname, ".* .*"), correct_host, 1==1, hostname) ] | eval hasAppBlueprints=if(hasAppBlueprints="true","CBP",hasAppBlueprints) | eval hasAppBlueprints=if(hasAppBlueprints="false","NonCBP",hasAppBlueprints) | table hostname, alert_id, incident_number, source_name, opened_time, hasAppBlueprints, state ... View more

@ITWhisperer  it is giving only per day data, where as i want to do this calculation during runtime. For every each day, it should calculate percentages ... View more

the query you ave given is not working. I did include earliest in my base search, but still it gives old data. Not sure from where its picking   index="ab" source_name=xy platformName=REDHAT earliest=-24h | table hostName, source_name, hasAppBlueprints | rename hostName as hostname | join type=inner max=0 hostname [ search index=abc source_name=xyz earliest=-21d | dedup incident_number | rex field=transfer_description "found as (?<correct_host>[a-zA-Z0-9\-]+) " | rename configuration_item as hostname | eval opened_time=strptime(opened_time, "%b %d, %Y %H:%M:%S") | table hostname, alert_id, incident_number, correct_host, opened_time | eval hostname=case(match(hostname, ".* .*"), correct_host, 1==1, hostname) ] | table hostname, alert_id, incident_number, source_name, opened_time, hasAppBlueprints ... View more

the query you ave given is not working. I did include earliest in my base search, but still it gives old data. Not sure from where its picking   index="ab" source_name=xy platformName=REDHAT earliest=-24h | table hostName, source_name, hasAppBlueprints | rename hostName as hostname | join type=inner max=0 hostname [ search index=abc source_name=xyz earliest=-21d | dedup incident_number | rex field=transfer_description "found as (?<correct_host>[a-zA-Z0-9\-]+) " | rename configuration_item as hostname | eval opened_time=strptime(opened_time, "%b %d, %Y %H:%M:%S") | table hostname, alert_id, incident_number, correct_host, opened_time | eval hostname=case(match(hostname, ".* .*"), correct_host, 1==1, hostname) ] | table hostname, alert_id, incident_number, source_name, opened_time, hasAppBlueprints ... View more

here _time> condition will print sep, oct,nov values as well, but my requirement is to print only previous months | savedsearch cbp_inc_base | eval _time=strftime(opened_time, "%Y/%m/%d") | where (_time<relative_time(now(),"-3d@d") AND _time>relative_time(now(),"-30d@d")) | bin _time span=1d ... View more

here _time> condition will print sep, oct,nov values as well, but my requirement is to print only previous months | savedsearch cbp_inc_base | eval _time=strftime(opened_time, "%Y/%m/%d") | where (_time<relative_time(now(),"-3d@d") AND _time>relative_time(now(),"-30d@d")) | bin _time span=1d ... View more

I am getting data like this, but i want data only for previous 30days _time false true 1 2021/07/21 1 0 2 2021/10/04 1 0 3 2021/10/14 2 0 4 2021/11/04   | savedsearch cbp_inc_base | eval _time=strftime(opened_time, "%Y/%m/%d") |eval _time = if(_time<relative_time(now(),"-3d@d") AND _time>relative_time(now(),"-30d@d")) | bin _time span=1d    /// this errors   | savedsearch cbp_inc_base | eval _time=strftime(opened_time, "%Y/%m/%d") |eval _time<relative_time(now(),"-3d@d")    /// this gives data for that particular day i.e. Dec 31st data   ... View more