topic Re: How to display timechart multivalues without colon? in Splunk Search

How to display timechart multivalues without colon?

LearningGuy — Tue, 05 Mar 2024 21:49:47 GMT

Hello,

I have a set of Grade (Math, English, Science) data for Student1 and Student2 from 2/8/2024 to 3/1/2024
How to display timechart multivalues without colon?

The complete search is down below. Thank you so much for your help.

This is the result with colon

Is it possible to display the data like the following?
Should I parse the data to get the display like below or is there a better way to do this?

Student	Grades	2/8/2024	2/15/2024	2/22/2024	2/29/2024
Student1	EnglishGrade	10	7	7	10
Student1	MathGrade	10	7	7	10
Student1	ScienceGrade	10	7	7	10
Student2	EnglishGrade	9	6	7	9
Student2	MathGrade	9	6	7	9
Student2	ScienceGrade	9	6	7	9

Here's the search

| makeresults format=csv data="_time,Student,MathGrade,EnglishGrade,ScienceGrade 1707368400,Student1,10,10,10 1707454800,Student1,9,9,9 1707541200,Student1,8,8,8 1707627600,Student1,7,7,7 1707714000,Student1,6,6,6 1707800400,Student1,5,5,5 1707886800,Student1,6,6,6 1707973200,Student1,7,7,7 1708059600,Student1,8,8,8 1708146000,Student1,9,9,9 1708232400,Student1,10,10,10 1708318800,Student1,10,10,10 1708405200,Student1,9,9,9 1708491600,Student1,8,8,8 1708578000,Student1,7,7,7 1708664400,Student1,6,6,6 1708750800,Student1,5,5,5 1708837200,Student1,6,6,6 1708923600,Student1,7,7,7 1709010000,Student1,8,8,8 1709096400,Student1,9,9,9 1709182800,Student1,10,10,10 1709269200,Student1,10,10,10 1707368400,Student2,9,9,9 1707454800,Student2,5,5,5 1707541200,Student2,6,6,6 1707627600,Student2,7,7,7 1707714000,Student2,8,8,8 1707800400,Student2,9,9,9 1707886800,Student2,5,5,5 1707973200,Student2,6,6,6 1708059600,Student2,7,7,7 1708146000,Student2,8,8,8 1708232400,Student2,9,9,9 1708318800,Student2,9,9,9 1708405200,Student2,5,5,5 1708491600,Student2,6,6,6 1708578000,Student2,7,7,7 1708664400,Student2,8,8,8 1708750800,Student2,9,9,9 1708837200,Student2,5,5,5 1708923600,Student2,6,6,6 1709010000,Student2,7,7,7 1709096400,Student2,8,8,8 1709182800,Student2,9,9,9 1709269200,Student2,9,9,9" | table _time, Student, MathGrade, EnglishGrade, ScienceGrade | timechart span=1w first(MathGrade) as MathGrade, first(EnglishGrade) as EnglishGrade, first(ScienceGrade) as ScienceGrade by Student useother=f limit=0 | eval _time = strftime(_time,"%m/%d/%Y") | fields - _span _spandays | transpose 0 header_field=_time column_name=Grades

Re: How to display timechart multivalues without colon?

yuanliu — Tue, 05 Mar 2024 23:07:53 GMT

Again, thank you for including data emulation in problem presentation. I tried to be more semantic but the syntax got more and more tangled. So this time, I will just use string manipulation.

| timechart span=1w@w first(MathGrade) as MathGrade, first(EnglishGrade) as EnglishGrade, first(ScienceGrade) as ScienceGrade by Student useother=f limit=0 | eval _time = strftime(_time,"%m/%d/%Y") | fields - _span _spandays | transpose 0 header_field=_time column_name=Grade | eval Grade = split(Grade, ": ") | eval Student = mvindex(Grade, 1), Grade = mvindex(Grade, 0) | table Student Grade * | sort Student

Here, I included snap-to @w which you asked about in the other question. Your emulated data gives

Student	Grade	02/04/2024	02/11/2024	02/18/2024	02/25/2024
Student1	EnglishGrade	10	6	10	7
Student1	MathGrade	10	6	10	7
Student1	ScienceGrade	10	6	10	7
Student2	EnglishGrade	9	8	9	6
Student2	MathGrade	9	8	9	6
Student2	ScienceGrade	9	8	9	6

Hope this helps.

Re: How to display timechart multivalues without colon?

LearningGuy — Wed, 06 Mar 2024 15:57:46 GMT

Hello @yuanliu,
I tried your suggestion and modified column name "Grades" into "Grade", and it worked fine. I accepted your solution
So, we had to split the data manually. Note that there is still an issue with snap-to is shifting the data as discussed in my other post.
I appreciate your assistance. Thank you