Hi - I am getting the data from logs into DT so when I am building a graph which has 2 lines one for current day and one for last week I am facing an issue where graph is plotting the lines for today but also having blank values or no data for last 7 days which is not required at all. So ideally it should start from today and plot the graph.
Problem:
Expected graph : (From different source)
DQL query I am using :
fetch logs , from:bin(now(),1d)-7d , to:now()-7d //, scanLimitGBytes: 500, samplingRatio: 1000
| filter matchesValue(log.source, "/abcd/xyz/temp.log")
| filter x=="1234"
| summarize count(),alias:TotalErrorsLW, by:{bin(timestamp, 30m), alias:TimeField, error_code }
| fieldsAdd helper=formatTimestamp(TimeField,format:"HH:mm")
| lookup [ fetch logs , from:bin(now(),1d) , to:now() //, scanLimitGBytes: 500, samplingRatio: 1000
| filter matchesValue(log.source, "/abcd/xyz/temp.log")
| filter x=="1234"
| summarize count(),alias:TotalErrors, by:{bin(timestamp, 30m),alias:TimeFieldToday, error_code }
| fieldsAdd helper=formatTimestamp(TimeFieldToday,format:"HH:mm")], sourceField:helper,lookupField:helper
| fieldsRemove helper, lookup.helper
| fieldsRename lookup.TotalErrors,alias:TotalErrorsToday
| filter isNotNull(lookup.error_code)
| fields error_code,lookup.TimeFieldToday,TotalErrorsToday,TotalErrorsLW
PFB the data when I am using table visualization:
Could you please help how can I solve this issue for line chart.
Featured Posts
