topic Re: Chart with multiple lines based on field values in Splunk Search

Chart with multiple lines based on field values

fhobelman — Fri, 27 Jul 2018 05:54:51 GMT

case:

Logged events with differentiating fuellevel and the corresponding serial

Desired outcome:

So a graph with multiple lines, a line is based on a serialnumbers from the events, with vertically the value of a field within that same event.

Please help!

Re: Chart with multiple lines based on field values

akocak — Fri, 27 Jul 2018 13:38:20 GMT

please send a sample of your data for better answer, however, I believe you are looking something similar to below:

 index=x sourcetype=y | eval number = fuellevel - correspondingserial | timechart values(number) values(serial1) values(serial2)

Re: Chart with multiple lines based on field values

DalJeanis — Sun, 29 Jul 2018 06:00:17 GMT

That's just a basic timechart.

your search that gets the events with _time serial and fuellevel
 | timechart max(fuellevel) as fuellevel by serial

You can also try max(), min(), avg() first() last(), or any other aggregate command that seems relevant.

Re: Chart with multiple lines based on field values

fhobelman — Mon, 30 Jul 2018 05:53:19 GMT

Thanks! That indeed gives me the max fuellevel per day! What is the option if I want to see it per event? Because some serials will have like 10 events per day and others will just have a few or even none on a day.