02-27-2025 02:54 AM
Hello @T.Nurmi ,
This took a whole lot of effort to make the query. Please refer to below:
config timeframe = 1y
| dataset = incidents
| filter status in (ENUM.RESOLVED_FALSE_POSITIVE, ENUM.RESOLVED_AUTO_RESOLVE)
| fields creation_time, status
| alter month = format_timestamp("%Y-%m", creation_time) // Year-Month format
| alter false_positive_count = if(status = ENUM.RESOLVED_FALSE_POSITIVE, 1, 0)
| alter auto_resolve_count = if(status = ENUM.RESOLVED_AUTO_RESOLVE , 1, 0)
| comp sum(false_positive_count) as false_positive_total, sum(auto_resolve_count) as auto_resolve_total by month
| replacenull false_positive_total = 0, auto_resolve_total = 0
| sort desc month
| view graph type = column subtype = grouped show_callouts = `true` xaxis = month yaxis = false_positive_total,auto_resolve_total seriescolor("false_positive_total","#ff0000") seriescolor("auto_resolve_total","#0000ff") xaxistitle = "Month" yaxistitle = "Number of Incidents" seriestitle("false_positive_total","Resolved False Positives") seriestitle("auto_resolve_total","Auto Resolved Incidents")
If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.
