Good day
I have two attributes for my graph which are over time. subscriber_ap (which should read the value on y axis) and subscriber_fup which is color.
I have managed to create the graph with subscriber_fup (color) but my subscriber_ap which is supposed to be a stacked graph it is not showing. if you find attached screenshot, when subscriber_ap = 0 it should count 4 bars on the y axis, if subscriber_fup is 200 it should be read, which means at a particular time we should have 4 red bars, if subscriber_ap=100 =3 bars on Y axis, when subscriber_fup is zero it should paint green hence have 3 green bars at that particular time
<chart>
<search>
<query>index=sandvine sourcetype=sql subscriber_name="$subscriberid$"
| eval 4 = if(subscriber_ap=200,subscriber_ap,0)
| eval 3 = if(subscriber_ap=150,subscriber_ap,0)
| eval 2 = if(subscriber_ap=100,subscriber_ap,0)
| eval 1 = if(subscriber_ap=0,subscriber_ap,0)
| eval green = if( subscriber_fup=0,subscriber_fup,0)
| eval yellow = if(subscriber_fup=100,subscriber_fup,0)
| eval orange = if(subscriber_fup=150,subscriber_fup,0)
| eval red = if(subscriber_fup=200,subscriber_fup,0)
| timechart span=30m values(green) as "Green" values(yellow) as "Yellow" values(orange) as "Orange" values(red) as "Red"
try this
index=sandvine sourcetype=sql subscriber_name="$subscriberid$"
| bin _time span=1h
| stats max(subscriber_ap) as SAP max(subscriber_fup) as FUP
| eval chartbars=round(SAP/50)
| eval chartcolor=case(FUP>=150,"orange", FUP>=100,"yellow", true(),"green")
| timechart span=1h max(chartbars) by chartcolor
try this
index=sandvine sourcetype=sql subscriber_name="$subscriberid$"
| bin _time span=1h
| stats max(subscriber_ap) as SAP max(subscriber_fup) as FUP
| eval chartbars=round(SAP/50)
| eval chartcolor=case(FUP>=150,"orange", FUP>=100,"yellow", true(),"green")
| timechart span=1h max(chartbars) by chartcolor