I am trying to build a visualization of change data to show over time the number of concurrent changes on going. So this bit I can do for a generic "All" categories of change or by any individual category in different charts. But the final requirement is to draw one chart with all 3 Categories shown distinctly. Here is where it goes wrong.
If I split the chart in the "All" search by "risk" (change category) the counts are very weird.
If I append the search for each category the numbers are correct, but the x-axis is repeated once for each time I append (??!)
If I Join the searches the x-axis is good, first search is good the others overlay a flat line based on the value of the first value on the x-axis.
Here is the search (in "Join" form) its complex!!!!
| inputlookup snow_change_subset.csv | search (Risk="Cat 1") AND (State != "Closed Complete") AND (State != "Cancelled")
| rename Start_date as Start End_date as Stop | eval Start=strptime(Start,"%d-%m-%Y %H:%M:%S"), Stop=strptime(Stop,"%d-%m-%Y %H:%M:%S") | eval start_time=relative_time(now(),"$Start_day$")
| eval futuretime=relative_time(start_time, "$Time_Range$") | eval Start = if(Startstart_time AND Startcount(Number), max(concurrent)-count(Number),0)) as "Cat 1"
| join [
| inputlookup snow_change_subset.csv | search (Risk="Cat 2") AND (State != "Closed Complete") AND (State != "Cancelled")
| rename Start_date as Start End_date as Stop | eval Start=strptime(Start,"%d-%m-%Y %H:%M:%S"), Stop=strptime(Stop,"%d-%m-%Y %H:%M:%S") | eval start_time=relative_time(now(),"$Start_day$")
| eval futuretime=relative_time(start_time, "$Time_Range$") | eval Start = if(Startstart_time AND Startcount(Number), max(concurrent)-count(Number),0)) as "Cat 2"]
Any ideas are welcome - the two variables for start_date and time range are whole days!
... View more