<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Charting series data in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/Charting-series-data/m-p/20916#M751</link>
    <description>&lt;P&gt;Or at any rate this usage of it. I've not seen that format to reference a field inline -- .fieldname. -- mentioned anywhere.&lt;/P&gt;</description>
    <pubDate>Wed, 28 Jul 2010 13:04:05 GMT</pubDate>
    <dc:creator>cmeo</dc:creator>
    <dc:date>2010-07-28T13:04:05Z</dc:date>
    <item>
      <title>Charting series data</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Charting-series-data/m-p/20913#M748</link>
      <description>&lt;P&gt;This seems to be a variation on a common theme, but I'm having trouble nutting it out.&lt;/P&gt;

&lt;P&gt;The data source CSV contains single lines each with a state, city, and 7-day forecast of min temperature, max temp, forecast description. Example:&lt;/P&gt;

&lt;P&gt;loc_id,location,state,forecast_date,issue_date,issue_time,min_0,max_0,min_1,max_1,min_2,
max_2,min_3,max_3,min_4,max_4,min_5,max_5,min_6,max_6,min_7,max_7,forecast_0,forecast_1,
forecast_2,forecast_3,forecast_4,forecast_5,forecast_6,forecast_7&lt;/P&gt;

&lt;P&gt;056037,Armidale,NSW,20100721,20100721,093748,,11,-3,12,-3,13,-3,14,,,,,,,,,Early frost. Mostly fine.,Early frost. Mostly sunny.,Early frost then fine.,Early frost then fine.,,,,,&lt;/P&gt;

&lt;P&gt;069134,Batemans Bay,NSW,20100721,20100721,055926,,15,2,15,2,17,2,16,,,,,,,,,Fine. Partly cloudy.,Fine. Mostly sunny.,Mostly fine.,Fine.,,,,,&lt;/P&gt;

&lt;P&gt;063005,Bathurst,NSW,20100721,20100721,055926,,11,,,,,,,,,,,,,,,Early frost. Mostly fine.,,,,,,,,&lt;/P&gt;

&lt;P&gt;069139,Bega,NSW,20100721,20100721,055926,,15,,,,,,,,,,,,,,,Fine. Partly cloudy.,,,,,,,,&lt;/P&gt;

&lt;P&gt;048013,Bourke,NSW,20100721,20100721,055926,,15,,,,,,,,,,,,,,,Fine. Partly cloudy.,,,,,,,,&lt;/P&gt;

&lt;P&gt;Note that some values are empty.&lt;/P&gt;

&lt;P&gt;What I want to do is filter by state and location and display today's forecast and also the 7 day forecast. E.g.&lt;/P&gt;

&lt;P&gt;TODAY: min 14, max 21, cloudy
Tomorrow: min 15, max 23, sunny
[is there some way to work out what day of week the next 5 entries are?] min x, max x, etc
...
...&lt;/P&gt;

&lt;P&gt;Charting min_[1-7], max_[1-7] and forecast_[1-7] is proving to be extremely tricky. I've had a look at the search commands and nothing seems to do what I want. It seems to me that what I need is a sort of 'reverse multikv' command to take a single line and split it into multiple events for charting. In addition this would need to make sure that items with same index, e.g. min_1, max_1 and forecast_1, stay together.&lt;/P&gt;

&lt;P&gt;There must be another way but I don't see it.&lt;/P&gt;</description>
      <pubDate>Tue, 27 Jul 2010 12:47:55 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Charting-series-data/m-p/20913#M748</guid>
      <dc:creator>cmeo</dc:creator>
      <dc:date>2010-07-27T12:47:55Z</dc:date>
    </item>
    <item>
      <title>Re: Charting series data</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Charting-series-data/m-p/20914#M749</link>
      <description>&lt;P&gt;try (version with only 3 days):&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;state=NSW location=Armidale 
| eval maxminfcst=split("0|".max_0."|".min_0."|".forecast_0.";".
                        "1|".max_1."|".min_1."|".forecast_1.";".
                        "2|".max_2."|".min_2."|".forecast_2.";".
                        "3|".max_3."|".min_3."|".forecast_3     ,
                     ";"
| mvexpand maxminfcst
| rex field=maxminfcst "(?&amp;lt;days&amp;gt;\d+)|(?&amp;lt;max&amp;gt;\d+)|(?&amp;lt;min&amp;gt;\d+)|(?&amp;lt;forecast&amp;gt;.*)"
| dayofweeknum=case(days=0,99, days=1,98, days&amp;gt;1,date_wday+days)
| lookup dayofweek_table dayofweeknum OUTPUT dayofweektext
| fields dayofweektext max min forecast
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;&lt;CODE&gt;dayofweek_table&lt;/CODE&gt; would be a hypothetical lookup table that mapped day numbers to a name:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;dayofweeknum,dayofweektext
0,Sunday
1,Monday
2,Tuesday
3,Wednesday
4,Thursday
5,Friday
6,Saturday
99,Today
98,Tomorrow
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Tue, 27 Jul 2010 13:20:49 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Charting-series-data/m-p/20914#M749</guid>
      <dc:creator>gkanapathy</dc:creator>
      <dc:date>2010-07-27T13:20:49Z</dc:date>
    </item>
    <item>
      <title>Re: Charting series data</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Charting-series-data/m-p/20915#M750</link>
      <description>&lt;P&gt;This is great, but the 'split' function is documented where exactly?&lt;/P&gt;</description>
      <pubDate>Wed, 28 Jul 2010 12:56:22 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Charting-series-data/m-p/20915#M750</guid>
      <dc:creator>cmeo</dc:creator>
      <dc:date>2010-07-28T12:56:22Z</dc:date>
    </item>
    <item>
      <title>Re: Charting series data</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Charting-series-data/m-p/20916#M751</link>
      <description>&lt;P&gt;Or at any rate this usage of it. I've not seen that format to reference a field inline -- .fieldname. -- mentioned anywhere.&lt;/P&gt;</description>
      <pubDate>Wed, 28 Jul 2010 13:04:05 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Charting-series-data/m-p/20916#M751</guid>
      <dc:creator>cmeo</dc:creator>
      <dc:date>2010-07-28T13:04:05Z</dc:date>
    </item>
    <item>
      <title>Re: Charting series data</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Charting-series-data/m-p/20917#M752</link>
      <description>&lt;P&gt;OK I see what this is doing. Mental!&lt;/P&gt;</description>
      <pubDate>Wed, 28 Jul 2010 13:45:56 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Charting-series-data/m-p/20917#M752</guid>
      <dc:creator>cmeo</dc:creator>
      <dc:date>2010-07-28T13:45:56Z</dc:date>
    </item>
    <item>
      <title>Re: Charting series data</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Charting-series-data/m-p/20918#M753</link>
      <description>&lt;P&gt;The "|" need to be escaped in the rex or this doesn't work properly:&lt;BR /&gt;
rex field=maxminfcst"(?&lt;DAYS&gt;\d+)|(?&lt;MAX&gt;\d+)|(?&lt;MIN&gt;\d+)|(?&lt;FORECAST&gt;.*)"&lt;/FORECAST&gt;&lt;/MIN&gt;&lt;/MAX&gt;&lt;/DAYS&gt;&lt;/P&gt;

&lt;P&gt;Otherwise, very clever indeed.&lt;/P&gt;</description>
      <pubDate>Wed, 28 Jul 2010 13:53:44 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Charting-series-data/m-p/20918#M753</guid>
      <dc:creator>cmeo</dc:creator>
      <dc:date>2010-07-28T13:53:44Z</dc:date>
    </item>
    <item>
      <title>Re: Charting series data</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Charting-series-data/m-p/20919#M754</link>
      <description>&lt;P&gt;okay, sorry. didn't actually test that, so yeah, possibly typos and mistakes like that in it.&lt;/P&gt;</description>
      <pubDate>Thu, 29 Jul 2010 01:16:46 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Charting-series-data/m-p/20919#M754</guid>
      <dc:creator>gkanapathy</dc:creator>
      <dc:date>2010-07-29T01:16:46Z</dc:date>
    </item>
    <item>
      <title>Re: Charting series data</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Charting-series-data/m-p/20920#M755</link>
      <description>&lt;P&gt;yeah, and it's not &lt;CODE&gt;split()&lt;/CODE&gt; function, it's really the &lt;CODE&gt;.&lt;/CODE&gt; concatenation operator that's probably confusing.&lt;/P&gt;</description>
      <pubDate>Thu, 29 Jul 2010 01:18:19 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Charting-series-data/m-p/20920#M755</guid>
      <dc:creator>gkanapathy</dc:creator>
      <dc:date>2010-07-29T01:18:19Z</dc:date>
    </item>
  </channel>
</rss>

