index=a host="b" source="0*_R_S_C_ajf" OWNER=dw* |eval ODate=strptime(ODATE,"%Y%m%d") |eval ODATE=strftime(ODate,"%Y-%m-%d") | eval TWIN_ID=substr(JOBNAME,7,2) |search ODATE="2022-07-13" TWIN_ID="CH" | xyseries TWIN_ID STATUS APPLIC |fillnull value="0" when i select TWIN_ID="CH" it is showing 3 counts but actuall count is 73.I think xyseries is removing duplicates can you please me on this my output is
TWIN_ID N VALUE Y
CH
DW_tz
DW_l6
DW_1b
cH
0
0
rs_rc
ch
0
DW_dwscd
DW_dwscd
i also tried alternate with chart over index=a host="b" source="0*_R_S_C_ajf" OWNER=dw* |eval ODate=strptime(ODATE,"%Y%m%d") |eval ODATE=strftime(ODate,"%Y-%m-%d") | eval TWIN_ID=substr(JOBNAME,7,2) | chart values(APPLIC) as APPLIC over TWIN_ID by STATUS |mvexpand N |fillnull value="0" MYOUTPUT Thank you in advance
... View more