Splunk Search

Chart with multiple lines based on field values

fhobelman
Engager

case:

Logged events with differentiating fuellevel and the corresponding serial

Desired outcome:

alt text

So a graph with multiple lines, a line is based on a serialnumbers from the events, with vertically the value of a field within that same event.

Please help!

Tags (2)

DalJeanis
Legend

That's just a basic timechart.

your search that gets the events with _time serial and fuellevel
 | timechart max(fuellevel) as fuellevel by serial

You can also try max(), min(), avg() first() last(), or any other aggregate command that seems relevant.

fhobelman
Engager

Thanks! That indeed gives me the max fuellevel per day! What is the option if I want to see it per event? Because some serials will have like 10 events per day and others will just have a few or even none on a day.

0 Karma

akocak
Contributor

please send a sample of your data for better answer, however, I believe you are looking something similar to below:

 index=x sourcetype=y | eval number = fuellevel - correspondingserial | timechart values(number) values(serial1) values(serial2) 
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...