I'm Having issues with my case statement. index=sti_123 source=rss_servers active = "1" status = "Being Commissioned" | eval Timenow=now() | eval days_since_provisioned = Timenow - date_provisioned | eval bucket = case(days_since_provisioned <=179, "Less Than 180", days_since_provisioned <= 210, "180-210", days_sinced_provisioned >= 210, "Greater Than 210") | chart count by bucket I believe it is the bucket case statement that is the issue, because I remove the "By bucket" and it gives me the correct total, but I just need to be able to say X server has been in this stage for A B or C length ... View more

I have a date in my SQL database that I want to group the data by that date and Type. The Year/Month/Week/Day each entry would count as 1. Example Dates 1/2/2018 - P 1/5/2018 - P 1/10/2018 - P 1/15/2018 - V 1/20/2018 - V 1/28/2018 - V Should Produce Jan - 6 Week 1 - 2P Week 2 - 1V 1P Week 3 - 1V Week 4 - 1V ... View more

So I have a question on how to report on multiple Categories. I want it so the Graph has like below. In my table, I have the fields Month ( 1 through 12) Week (1 through 52) platform (Virtual / Physical) ::: = Physical --- = Virtual Jan: Week1 (::::::::::::::::::::::::::::)(----------------------) : Week2 (::::::::::::::::::::)(---------------------) : Week3 (:::::::::::::::::::::::::::::::::::)(----) : Week4 (:::::::::::::::::::::::::::::::::::::::)(-----------------------) I am using this search below, and it works perfectly for either Week or Month but not both. | dbxquery query="SELECT * FROM \"ESAO\".\"dbo\".\"CST.provisioning\" where Year = Year(GETDATE())" connection="ESAO_DB" | chart count Over Week by platform ... View more