Splunk Search

How to create a chart based on condition

balajsoz
Path Finder

Hi,

Am having the data contains below;
Asset Time stamp Temperature
LD-02 00:12.6 43 41

HT-02 00:26.3 45 59

GR-02 00:33.6 52 42

LD-02 00:57.8 47 79

This are few examples of my data(actually am having 5000 rows of same kind of data for different assests) and from this i need to make a timechart which should display a trend for each Asset what is the temperature value.
pls help to find how to filter particular set of assets with its temperature

Tags (1)
0 Karma

sideview
SplunkTrust
SplunkTrust

If you only have a couple Asset values, and assuming that the timestamp extraction was set up properly when the data input was set up, you can just do

<your search terms> | timechart avg(Temperature) by Asset

On the other hand if you have a very large number of Asset values, you probably want to build some kind of search or filtering UI so that the user can narrow down the kind of assets that they want to see.

I've actually built an interface called 'Explore' as one of the Sample interfaces in Sideview Utils, and you might take a look at that because it's designed for data just like this -- reams and reams of points, like SCADA data or data from various automation technologies. You configure the 'Explore' interface just by setting a couple macros. So although it ships in Sideview Utils with those macros set so that it lets you 'explore' Splunk's internal metrics data, you can set those macros yourself so as to retarget the entire Explore interface over to your own custom data. In the end the users can click and browse and filter around in the hierarchy of the SCADA infrastructure that you have, generating reports on the fly and drilling down for more detail whenever they like. http://sideviewapps.com/apps/sideview-utils

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...