Splunk Search

How to create a chart based on condition

balajsoz
Path Finder

Hi,

Am having the data contains below;
Asset Time stamp Temperature
LD-02 00:12.6 43 41

HT-02 00:26.3 45 59

GR-02 00:33.6 52 42

LD-02 00:57.8 47 79

This are few examples of my data(actually am having 5000 rows of same kind of data for different assests) and from this i need to make a timechart which should display a trend for each Asset what is the temperature value.
pls help to find how to filter particular set of assets with its temperature

Tags (1)
0 Karma

sideview
SplunkTrust
SplunkTrust

If you only have a couple Asset values, and assuming that the timestamp extraction was set up properly when the data input was set up, you can just do

<your search terms> | timechart avg(Temperature) by Asset

On the other hand if you have a very large number of Asset values, you probably want to build some kind of search or filtering UI so that the user can narrow down the kind of assets that they want to see.

I've actually built an interface called 'Explore' as one of the Sample interfaces in Sideview Utils, and you might take a look at that because it's designed for data just like this -- reams and reams of points, like SCADA data or data from various automation technologies. You configure the 'Explore' interface just by setting a couple macros. So although it ships in Sideview Utils with those macros set so that it lets you 'explore' Splunk's internal metrics data, you can set those macros yourself so as to retarget the entire Explore interface over to your own custom data. In the end the users can click and browse and filter around in the hierarchy of the SCADA infrastructure that you have, generating reports on the fly and drilling down for more detail whenever they like. http://sideviewapps.com/apps/sideview-utils

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...