Hi,
How can i display last 3 months data monthly wise count as trend dashboard.To check whether monthly increasing or decreaing data.
index="os" sourcetype="Service" CaseNumber=* status=* assignment=* |dedup _time,CaseNumber,assignment_group| streamstats current=f last(assignment_group) as lg, last(active) as Active by CaseNumber | eval ss=case(assignment!=lg AND assignment="Susta","Escalated",assignment="Susta" AND status="Complete" AND (isnull(Active) OR Active="true"),"Resolved") |timechart count by ss usenull=f
How can i display monthly wise count as trend in dashboard
@udaypulipaka ,
Please accept the answer if it worked for you!.
Try this,
You can use span in timechart
https://docs.splunk.com/Documentation/SplunkCloud/7.2.3/SearchReference/Timechart
Your search | timechart span=3mon count by ss usenull=f
index="os" sourcetype="Service" CaseNumber=* status=* assignment=* |dedup _time,CaseNumber,assignment|streamstats current=f last(assignment) as lg, last(active) as Active by CaseNumber | eval is_escalated= if(assignment!=lg AND assignment="Susta",1,NULL)
|eval is_resolved=if(assignment_group="Susta" AND status="Complete" AND (isnull(Active) OR Active="true"),1,NULL)| chart count(is_escalated) AS "Escalated Cases" count(is_resolved) AS "Resolved Cases" by Component
For this query i need linechart.when i add timechart to this query it is showing all the components in below.It looks not gud.So can u help how to do trend for this query.
can you try this,
your search | bin span=3mon _time |stats count(ss) as count by _time
timechart span=3mon count by ss usenull=f this is working fine.Thank u for your help