Hi, I am sorry if this has been asked previously.
In effect, I look for a number of current day wires, and compare that to wires a week ago.
I need to display current day wires (Total_Today) as a line chart and change the color of the line based on a calculation (at present it is a percentage but this may change). These are repesented by eval greencCount, redCount, YellowCount.
Any help is truly appreciated.
index= IndexA source="SourceA" TRXTYPE="Wires" earliest=-0@d latest=now
| timechart span=1h count by TRXTYPE limit=25
| accum "Wires" as accum_Total_Today
| timechart last(accum_*) as * span=1h
| appendcols
[search index=IndexA source="SourceA" TRXTYPE="Wires" earliest=-7d@d enddaysago=7
| timechart span=1h count by TRXTYPE limit=25
| accum "Wires" as accum_Total_Week_Ago
| timechart last(accum_*) as * span=1h | eval _time=_time+(604800)
] | eval greenCount = if(Total_Today >= Total_Week_Ago,Total_Today,0)
| eval yellowCount = if(Total_Today < Total_Week_Ago AND Total_Today/Total_Week_Ago*100 <=70,Total_Today,0)
| eval redCount = if(Total_Today < Total_Week_Ago AND Total_Today/Total_Week_Ago*100 >70, Total_Today, 0)
| table _time Total_Today
