hi,
by running this query in search field
index="New" "Phase * ended" | table phaseinformation , phase_ended , datetime | rename datetime as DATE , phaseinformation as Phase_Info , phase_ended as Phase_End_Time | sort Phase_End_Time by desc
i got the following output
Phase_info Phase_End_Time DATE
phase 1 ended 1200 secs jul 16 12:04:44
phase 0 ended 1000 secs jul 16 11:02:48
now i can make chart of this by simply clicking on reports..but i am not able to get clear representation of phase_info on x axis and phase_end_time on y axis....
so need to make a clear graph..
Without a larger data set to look at, and without more details about what you want, it's hard to provide direction. You could do a chart that provides the SUM or AVG (average) Phase_End_Time for each Phase_Info value, but just plotting the End Time values for the Phase_Info values isn't going to provide you any value over a table of the results.
You can't do a chart to show that the event came at that time. Some numerical value is needed to plot a graph , e.g. time per phase_info. Thanks
can you explain more...