Splunk Search

How to have multiple time series charts of multiple days' temperature measurements during the days stacked for 24 hours

yshen
Communicator


I want to compare the daily temperature measurements at the same period, but different days by a stacked temperature time series for multiple days.
Using timechart I have the following query to organize the data, as the _time value contains the date information, the resulted visualization yields no stacked but one after another.

 

index="weather" sourcetype=publicweatherdata (Location=C60*)
| fields _time, Location, Temperature
| eval Date=strftime(_time, "%D")
| timechart span=30m max(Temperature) AS Temperature BY Date

 

I tried to only retain the hour, minutes in _time, resulting all _time value of the date of 20222-07-06, when I executed the query,
I could have the time series chart stacked but it shows with much of the horizontal space blank!
Here is the query alternative:

 

index="weather" sourcetype=publicweatherdata (Location=C60*)
| fields _time, Location, Temperature
| eval Date=strftime(_time, "%D")
| eval hour_min=strftime(_time, "%H:%M")
| eval _time = strptime(hour_min, "%H:%M")
| timechart span=30m max(Temperature) AS Temperature BY Date

 

How can I improve the visualization to make time series stacked with x-axis free from the dates?

Below are the charts needing improvement. Thanks!

stacked-but-tiny.png.pngnot-stacked.png.png

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

index="weather" sourcetype=publicweatherdata (Location=C60*)
| fields _time, Location, Temperature
| timechart span=30m max(Temperature) AS Temperature
| timewrap 1d

View solution in original post

yshen
Communicator

Thanks for the perfect solution!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

index="weather" sourcetype=publicweatherdata (Location=C60*)
| fields _time, Location, Temperature
| timechart span=30m max(Temperature) AS Temperature
| timewrap 1d
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...