How to create a chart based on condition

balajsoz — Thu, 14 Feb 2013 04:30:15 GMT

Hi,

Am having the data contains below;
Asset Time stamp Temperature
LD-02 00:12.6 43 41

HT-02 00:26.3 45 59

GR-02 00:33.6 52 42

LD-02 00:57.8 47 79

This are few examples of my data(actually am having 5000 rows of same kind of data for different assests) and from this i need to make a timechart which should display a trend for each Asset what is the temperature value.
pls help to find how to filter particular set of assets with its temperature

Re: How to create a chart based on condition

sideview — Thu, 14 Feb 2013 07:34:59 GMT

If you only have a couple Asset values, and assuming that the timestamp extraction was set up properly when the data input was set up, you can just do

<your search terms> | timechart avg(Temperature) by Asset

On the other hand if you have a very large number of Asset values, you probably want to build some kind of search or filtering UI so that the user can narrow down the kind of assets that they want to see.

I've actually built an interface called 'Explore' as one of the Sample interfaces in Sideview Utils, and you might take a look at that because it's designed for data just like this -- reams and reams of points, like SCADA data or data from various automation technologies. You configure the 'Explore' interface just by setting a couple macros. So although it ships in Sideview Utils with those macros set so that it lets you 'explore' Splunk's internal metrics data, you can set those macros yourself so as to retarget the entire Explore interface over to your own custom data. In the end the users can click and browse and filter around in the hierarchy of the SCADA infrastructure that you have, generating reports on the fly and drilling down for more detail whenever they like. http://sideviewapps.com/apps/sideview-utils

topic Re: How to create a chart based on condition in Splunk Search

How to create a chart based on condition

Re: How to create a chart based on condition