Showing results for 
Show  only  | Search instead for 
Did you mean: 

A problem with line chart in Grail's last week data comparison from logs data


Hi - I am getting the data from logs into DT so when I am building a graph which has 2 lines one for current day and one for last week I am facing an issue where graph is plotting the lines for today but also having blank values or no data for last 7 days which is not required at all. So ideally it should start from today and plot the graph.




Expected graph : (From different source)


DQL query I am using : 

fetch logs , from:bin(now(),1d)-7d , to:now()-7d //, scanLimitGBytes: 500, samplingRatio: 1000
| filter matchesValue(log.source, "/abcd/xyz/temp.log")
| filter x=="1234"
| summarize count(),alias:TotalErrorsLW, by:{bin(timestamp, 30m), alias:TimeField, error_code }
| fieldsAdd helper=formatTimestamp(TimeField,format:"HH:mm")
| lookup [ fetch logs , from:bin(now(),1d) , to:now() //, scanLimitGBytes: 500, samplingRatio: 1000
| filter matchesValue(log.source, "/abcd/xyz/temp.log")
| filter x=="1234"
| summarize count(),alias:TotalErrors, by:{bin(timestamp, 30m),alias:TimeFieldToday, error_code }
| fieldsAdd helper=formatTimestamp(TimeFieldToday,format:"HH:mm")], sourceField:helper,lookupField:helper
| fieldsRemove helper, lookup.helper
| fieldsRename lookup.TotalErrors,alias:TotalErrorsToday
| filter isNotNull(lookup.error_code)
| fields error_code,lookup.TimeFieldToday,TotalErrorsToday,TotalErrorsLW


PFB the data when I am using table visualization:



Could you please help how can I solve this issue for line chart.





Community Team
Community Team

Hello @amrit3671 ,
Thank you for providing so many details! Have you found the solution for your issue already, or do you still require our assistance? Let me know because then I'll seek some help. And if you did manage to solve it - would you like to share how with the Community? 😉 

Featured Posts