I have a dashboard with two visualizations. One is a panel with a time series chart that shows when a specific even was sent from a system, and how many that where sent. I’ve used time shift of offset the starting point of the chart so it aligns with the start of a day, ie. 00:00. And when I query “Last 2 days” I get two nice bumps that show how the events were sent during opening hours 2 and 1 days ago from 00:00….23:59 — and not some varying result depending on what time of the day I made the query. This works perfectly!
The other panel is a bar chart. This doesn’t work as expected. I want it to somewhat depict the same information, but instead count total number of events pr. day and represent this with a bar pr. day. It uses the same time shift for alignment, and I would really like to see a bar aligned with each bump of the time series panel above. But for some reason, I always get an extra, unwanted bar, which I can’t explain!
Is there a better way to do this time shift to align with start of day? I’ve tried all sorts of 1d/d, now-0d/d and what not in the hopes of making the two panels behave the same, but it only makes things worse.
I switch to Table view to get a clear view of the result, and your suggestion only provides a single value for the current day. I tried to fiddle with the other values I already had in the query, to see if they mangled the result, but I didn’t help.
Can you provide a full example? Maybe that’s easier that patching my broken chart?
I want:
A bar char with a bar for each day.
A day starts at 00:00:00 and ends at 23:59:59
Each bar represent a count of events for that given day.
Example: If I query for the “Last 2 days” and today is Wednesday, I expect the output below. Since today (Wednesday) is still on-going and therefore can’t contain a complete dataset from 00:00:00-23:59:59, Wednesday is not included:
Last 2 days
(today is wedneday)
20 -|
| 15
10 -| 8 ###
| ### ###
0 -|___________###____________###__________
monday tuesday
I’ve investigated a some more. And my time shift actually works nicely; it results in the dataset that I expect. I can confirm this when I view in the Table view.
So it’s just the visual presentation that’s difficult. One perhaps simple hack, would be to dynamically add a label, day, that’s built by formatting Time or tsNs. If I could format this as “YYYY-MM-DD” I would have a reliable day-key, that could count values by. Is this possible? And how? =)
Thanks, but I think you misunderstood. My labels themselves are not the problem in question.
I tried to propose a way to generate a “date-key” from the Time or tsNs. I would then use this date-key for reliably grouping data for my bars.
My problem is still:
How do draw bars that count log lines pr. whole day (00:00-23:59)?
How do I get rid of that extra bar that always appears on the bar chart?
The interesting/annoying thing is, that if I display the resulting data as a table view, I can verify that I get exactly what I want. Even the timeline graph displays it correctly. But the bar chart somehow always gets it wrong.
I’ve made a mock-up that illustrates the dashboard that I’m trying to build. The important thing about now, is that it doesn’t matter what hh:mm:ss is; because only whole days (00:00:00-23:59:59) are shown. So for “last 2 days” a time shift occurs so the two previous whole days are shows.