Splunk Search

How to create a chart based on condition

balajsoz
Path Finder

Hi,

Am having the data contains below;
Asset Time stamp Temperature
LD-02 00:12.6 43 41

HT-02 00:26.3 45 59

GR-02 00:33.6 52 42

LD-02 00:57.8 47 79

This are few examples of my data(actually am having 5000 rows of same kind of data for different assests) and from this i need to make a timechart which should display a trend for each Asset what is the temperature value.
pls help to find how to filter particular set of assets with its temperature

Tags (1)
0 Karma

sideview
SplunkTrust
SplunkTrust

If you only have a couple Asset values, and assuming that the timestamp extraction was set up properly when the data input was set up, you can just do

<your search terms> | timechart avg(Temperature) by Asset

On the other hand if you have a very large number of Asset values, you probably want to build some kind of search or filtering UI so that the user can narrow down the kind of assets that they want to see.

I've actually built an interface called 'Explore' as one of the Sample interfaces in Sideview Utils, and you might take a look at that because it's designed for data just like this -- reams and reams of points, like SCADA data or data from various automation technologies. You configure the 'Explore' interface just by setting a couple macros. So although it ships in Sideview Utils with those macros set so that it lets you 'explore' Splunk's internal metrics data, you can set those macros yourself so as to retarget the entire Explore interface over to your own custom data. In the end the users can click and browse and filter around in the hierarchy of the SCADA infrastructure that you have, generating reports on the fly and drilling down for more detail whenever they like. http://sideviewapps.com/apps/sideview-utils

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...