topic Re: How to select all existing values for multiple fields over time and plot them? in Dashboards & Visualizations

How to select all existing values for multiple fields over time and plot them?

beetaj — Thu, 14 Mar 2019 08:51:38 GMT

Hi all,

I have a set of log data like this below:

How do I plot all available data for all these fields over LogTime?
Thanks.

Re: How to select all existing values for multiple fields over time and plot them?

vinod94 — Thu, 14 Mar 2019 11:27:49 GMT

hi dyude @beetaj ,

You can try this

Your index | chart list(Fiield1) as Field1 list(Field2) as Field2 list(Field3) as Field3 list(Field4) as Field4 list(Field5) as Field5  by LogTime

Re: How to select all existing values for multiple fields over time and plot them?

beetaj — Thu, 14 Mar 2019 14:39:13 GMT

thanks @vinod94 ,

It helped with the statistics/tabular view, but the visualisation doesn't plot anything, tried different graphs, apparently they plot by count, I want the exact data to be dotted on the graph. so that I can see the pattern.
How do I fix the graph?

Re: How to select all existing values for multiple fields over time and plot them?

damann — Thu, 14 Mar 2019 15:15:27 GMT

If you have a basesearch that gives you exactly the table you provided above you can simply do:
basesearch | timechart values(Field*) by Field*

Re: How to select all existing values for multiple fields over time and plot them?

beetaj — Thu, 14 Mar 2019 15:26:16 GMT

Thanks @damann ,
timechart is not particularly helpful as it works based on the event time (index time), where the LogTime above is an indexed field extracted from my log data. Therefore I need a query/function combination that works based on LogTime

Re: How to select all existing values for multiple fields over time and plot them?

vinod94 — Fri, 15 Mar 2019 06:05:12 GMT

hi dyude @beetaj ,

Iam able to see the chart wrt your values.!

sorry for the typo mistake in the above query..

Your index | chart list(Field1) as Field1..... *

Re: How to select all existing values for multiple fields over time and plot them?

beetaj — Fri, 15 Mar 2019 09:24:07 GMT

Thanks @vinod94 ,
I am really puzzled why I am not getting any graphs! The only difference to the above data is that I have too many more events. However I do it the scale on Y-Axis stays 0-100, but according to the attached values of f1 goes well beyond 100.

Re: How to select all existing values for multiple fields over time and plot them?

vinod94 — Fri, 15 Mar 2019 09:26:10 GMT

@beetaj,

Can u post a screenshot ? Mostly it shouldn't effect.

Re: How to select all existing values for multiple fields over time and plot them?

vinod94 — Fri, 15 Mar 2019 09:28:47 GMT

try running this search .. ive kept some different values

| makeresults 
| eval Field1="20.7,100,56,45,400" 
| makemv delim="," Field1 
| mvexpand Field1 
| appendcols 
    [| makeresults 
    | eval Field2="93,15,23.6,10.5,11" 
    | makemv delim="," Field2 
    | mvexpand Field2]
|appendcols 
    [| makeresults 
    | eval Field3="45.1,42.4,67.6,45,90" 
    | makemv delim="," Field3 
    | mvexpand Field3]
|appendcols 
    [| makeresults 
    | eval LogTime="10/03/2019 08:25:09,12/03/2019 08:25:09,13/03/2019 08:25:09,14/03/2019 08:25:09,15/03/2019 08:25:09" 
    | makemv delim="," LogTime 
    | mvexpand LogTime]
|chart list(Field1) as Field1 list(Field2) as Field2 list(Field3) as Field3   by LogTime

Re: How to select all existing values for multiple fields over time and plot them?

nickhills — Fri, 15 Mar 2019 09:47:39 GMT

Hi @beetaj

You can use the "LogTime" to plot a timechart.

basesearch|eval _time=strptime(LogTime,"%d/%m/%Y %H:%M:%S")| timechart values(Field*) by Field*

Re: How to select all existing values for multiple fields over time and plot them?

beetaj — Fri, 15 Mar 2019 19:28:56 GMT

Thanks @vinod94 ,
I accept your response as Answer, and I am able to plot the expected graphs when I test it with some controlled dataset. But when I apply to my real data, I get no graph. Real data volume is high but it shouldn't matter as I filter it down to one second which I have only few events, still no graph is produced!
I had attached screenshots unfortunately not moderated yet!