topic Re: How to append string to timechart data labels? in Splunk Search

How to append string to timechart data labels?

dzyfer — Mon, 23 May 2022 08:05:21 GMT

Hi, I have a column timechart with numerical values, and I would like to add strings, or characters, after these values, when displayed on the dashboard.

I have tried to append the string to the results themselves, but it seems like timechart is unable to populate non-numerical data.

Any help or alternative ideas on how I can achieve the above results visually? Thanks.

Re: How to append string to timechart data labels?

gcusello — Mon, 23 May 2022 09:13:27 GMT

Hi @dzyfer,

could you share your search and what's the field containing the values "A", "B", "C", etc...?

Ciao.

Giuseppe

Re: How to append string to timechart data labels?

dzyfer — Tue, 24 May 2022 01:12:41 GMT

Hi Giuseppe, thank you for the reply.

My search is roughly along these lines

...
| timechart span=8h aligntime=@d+7h sum(meter) AS "output"
| eval date=strftime(_time,"%H:%M")
| eval shift = case(date="07:00","A", date="15:00","B", date="23:00","C")
| eval "output" = 'output' + " " + shift

Re: How to append string to timechart data labels?

gcusello — Tue, 24 May 2022 06:20:52 GMT

Hi @dzyfer,

you should use eval before timechart and use the by in timechart, something like this:

| eval date=strftime(_time,"%H:%M") | eval shift = case(date="07:00","A", date="15:00","B", date="23:00","C") | timechart span=8h aligntime=@d+7h sum(meter) AS "output" BY shift

Ciao.

Giuseppe

Re: How to append string to timechart data labels?

dzyfer — Tue, 24 May 2022 09:31:09 GMT

Hi @gcusello , I made some edits to your suggestion, and have come up with satisfiable results, thank you.