Splunk Search

How to append string to timechart data labels?

dzyfer
Path Finder

Hi, I have a column timechart with numerical values, and I would like to add strings, or characters, after these values, when displayed on the dashboard.

Capture.PNG

I have tried to append the string to the results themselves, but it seems like timechart is unable to populate non-numerical data.

Any help or alternative ideas on how I can achieve the above results visually? Thanks.

 

Labels (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @dzyfer,

you should use eval before timechart and use the by in timechart, something like this:

| eval date=strftime(_time,"%H:%M")
| eval shift = case(date="07:00","A", date="15:00","B", date="23:00","C")
| timechart span=8h aligntime=@d+7h sum(meter) AS "output" BY shift

Ciao.

Giuseppe

View solution in original post

dzyfer
Path Finder

Hi Giuseppe, thank you for the reply. 

My search is roughly along these lines

...
| timechart span=8h aligntime=@d+7h sum(meter) AS "output" 
| eval date=strftime(_time,"%H:%M")
| eval shift = case(date="07:00","A", date="15:00","B", date="23:00","C")
| eval "output" = 'output' + " " + shift

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @dzyfer,

you should use eval before timechart and use the by in timechart, something like this:

| eval date=strftime(_time,"%H:%M")
| eval shift = case(date="07:00","A", date="15:00","B", date="23:00","C")
| timechart span=8h aligntime=@d+7h sum(meter) AS "output" BY shift

Ciao.

Giuseppe

dzyfer
Path Finder

Hi @gcusello , I made some edits to your suggestion, and have come up with satisfiable results, thank you.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @dzyfer,

could you share your search and what's the field containing the values "A", "B", "C", etc...?

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...