I have my search query being as such where I am displaying the tickets, flowing in and out. Now, i want to put a line indicating the backlog on my chart.
index="tickets" $year$ | dedup number
| convert timeformat="%Y-%m-%d %H:%M:%S" num(allFields.createdDate) As days
| eval week=strftime(days,"%V")
| eval year = strftime(days, "%Y")
| where year= c_year
| stats count by week
| appendcols [search index="tickets" $year$ | dedup number | search state != "Resolved" AND state != "Closed" AND state != "Resolution Confirmed" AND assignment_group != "Out of Scope" | convert timeformat="%Y-%m-%d %H:%M:%S" num(createdDate) As date
| eval weeks=strftime(date,"%V")
| eval year = strftime(date, "%Y")
| where year= c_year | chart count by weeks
]
| appendcols [search index="tickets" $year$ | dedup number
| search state = "Resolved" OR state = "Resolution Confirmed" OR state = "Closed"
| convert timeformat="%Y-%m-%d %H:%M:%S" num(resolvedOn) As days
| eval out = strftime(days, "%V")
| eval year = strftime(days, "%Y")
| where year= c_year
| chart count by out]
Basically, how can i make the field 'createdDate' used in first query and first subquery to be common on my chart? The way i did it, the subquery has its own axis, which i do not want. Please refer to the picture:![alt text][1]
What I am getting is this : (where weeks is my backlog)
![alt text][2]
Any help will be much appreciated!
[1]: /storage/temp/290878-backlog.jpg
[2]: /storage/temp/290879-mybacklog.jpg
↧