Is there a way to put them both the bars on a single scale? ... View more

Apologies for picking up this old topic and not listening to you previously but I get your concern now. Can you help me sort it while letting me visually keep the "%B %Y" format? "%Y-%m" works but I think %B %Y is visually more appealing. ... View more

Salut! You Sir are a true genius! ... View more

Someone please convert this comment to an answer!!! ... View more

Interesting. I understand now. I used the "%B %Y" format and then used the trellis view. Maybe there's more processing involved but there's no confusion here I guess. Thank you for the great advice btw. I can use it in other charts that I have. I never thought that reading date could be such ambiguous across cultures and boundaries. Thank you for pointing that out. ... View more

Thank you for your help. This solved my problem: base search|convert timeformat="%Y-%m-%d %H:%M:%S" mktime(time*)|eval total_time=((time_complete-time_initial))|rename total_time as total_time_avg|eval "Average Time to Complete"=case(total_time_avg<=120,"0-2",total_time_avg<=300,"3-5",total_time_avg<=600,"6-10",total_time_avg<=1200,"11-20",1=1,">20")|fields - total_time_avg| timechart count by "Average Time to Complete" I would convert this to an answer but I don't have the permissions. ... View more

Sorry from my end too but there was a gap in description of the problem. I want to know the count of values that landed in these groups in a time frame. So if there's a trendline visualization, there should be 5 trendlines for each of these groups showing how many of these time averages landed in each group in that time frame. ... View more

It does not solve. This is how it looks: 2017-08-27 >20 1.3433333333333333 2017-08-28 >20 0.9136054421768706 2017-08-29 >20 1.1056265984654732 2017-08-30 >20 1.1308823529411764 Every value out there is ">20" ... View more

I appreciate your concern. I can't simply understand how will that help me? Is something bad about the format I posted in? ... View more

You Rock! Thanks! ... View more

It's not the format of time that I wish to change. I want the charts to look in such a way that the header says the Month and then below each month it splits the respective pie by FinalState. Is such a thing even possible? ... View more

Okay, so I finally got what I wanted but now I want to use a time modifier and I can't wrap my head around those concepts. The date that it selects in the last value is from Thursday to Thursday. Instead I want it Monday to Monday. Please help: index=comos sourcetype=comos | where State in ("Closed","Resolved") | rename "Resolving Time" as rt | convert timeformat="%Y-%m-%d %H:%M:%S" mktime(Resolved) | eval _time = relative_time(Resolved,"@w") |timechart span=1w count as "Number of Tickets" eval(round(avg(rt),2)) as "Average Operational Time" |eval Time=strftime(_time, "%U %Y") ... View more

One little addon that I wanted to do was to have the timechart but display the week numbers instead of dates. I did this: index=comos sourcetype=comos | where State in ("Closed","Resolved") | rename "Resolving Time" as rt | convert timeformat="%Y-%m-%d %H:%M:%S" mktime(Resolved) | eval _time=relative_time(Resolved,"@w") |eval weeknumber=strftime(Resolved,"%U %Y") |timechart span=1w count as "Number of Tickets" eval(round(avg(rt),2)) as "Average Operational Time" by weeknumber but somehow the data is sorted as string and the sorting is all messed up. ... View more

Sorted. Got it. I did this: index=comos sourcetype=comos | where State in ("Closed","Resolved") | rename "Resolving Time" as rt | convert timeformat="%Y-%m-%d %H:%M:%S" mktime(Resolved) | eval _time = relative_time(Resolved,"@w") |timechart span=1w count as "Number of Tickets" eval(round(avg(rt),2)) as "Average Operational Time" I wish I could convert it to an answer. Converted it for you and removed the old comment from the code, since it is no longer true. Thanks for posting your final working code! ... View more

Can you also help with this last query? I have what I need. I only wish to hide the computer field xx from the Visualization. index=comos sourcetype=comos | where State in ("Closed","Resolved") | rename COMMENT as "right here you should also eliminate any records closed in prior weeks" | rename "Resolving Time" as rt | convert timeformat="%Y-%m-%d %H:%M:%S" mktime(Created) mktime(Resolved) | eval tt=(Resolved-Created) | eval _time = relative_time(Resolved,"@w") | timechart span=1w count as yy sum(rt) as xx |eval zz= xx/yy ... View more

And what should I do when you say: | rename COMMENT as "right here you should also eliminate any records closed in prior weeks" ... View more