cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

A problem with line chart in Grail's last week data comparison from logs data

amrit3671
Observer

Hi - I am getting the data from logs into DT so when I am building a graph which has 2 lines one for current day and one for last week I am facing an issue where graph is plotting the lines for today but also having blank values or no data for last 7 days which is not required at all. So ideally it should start from today and plot the graph.

Problem:

amrit3671_0-1696402239133.png

 

Expected graph : (From different source)

amrit3671_1-1696402296895.png

DQL query I am using : 

fetch logs , from:bin(now(),1d)-7d , to:now()-7d //, scanLimitGBytes: 500, samplingRatio: 1000
| filter matchesValue(log.source, "/abcd/xyz/temp.log")
| filter x=="1234"
| summarize count(),alias:TotalErrorsLW, by:{bin(timestamp, 30m), alias:TimeField, error_code }
| fieldsAdd helper=formatTimestamp(TimeField,format:"HH:mm")
| lookup [ fetch logs , from:bin(now(),1d) , to:now() //, scanLimitGBytes: 500, samplingRatio: 1000
| filter matchesValue(log.source, "/abcd/xyz/temp.log")
| filter x=="1234"
| summarize count(),alias:TotalErrors, by:{bin(timestamp, 30m),alias:TimeFieldToday, error_code }
| fieldsAdd helper=formatTimestamp(TimeFieldToday,format:"HH:mm")], sourceField:helper,lookupField:helper
| fieldsRemove helper, lookup.helper
| fieldsRename lookup.TotalErrors,alias:TotalErrorsToday
| filter isNotNull(lookup.error_code)
| fields error_code,lookup.TimeFieldToday,TotalErrorsToday,TotalErrorsLW

 

PFB the data when I am using table visualization:

amrit3671_2-1696402539204.png

 

Could you please help how can I solve this issue for line chart.

 

 

 

1 REPLY 1

IzabelaRokita
Community Team
Community Team

Hello @amrit3671 ,
Thank you for providing so many details! Have you found the solution for your issue already, or do you still require our assistance? Let me know because then I'll seek some help. And if you did manage to solve it - would you like to share how with the Community? 😉 

Featured Posts