Splunk Search

How to have multiple time series charts of multiple days' temperature measurements during the days stacked for 24 hours

yshen
Communicator


I want to compare the daily temperature measurements at the same period, but different days by a stacked temperature time series for multiple days.
Using timechart I have the following query to organize the data, as the _time value contains the date information, the resulted visualization yields no stacked but one after another.

 

index="weather" sourcetype=publicweatherdata (Location=C60*)
| fields _time, Location, Temperature
| eval Date=strftime(_time, "%D")
| timechart span=30m max(Temperature) AS Temperature BY Date

 

I tried to only retain the hour, minutes in _time, resulting all _time value of the date of 20222-07-06, when I executed the query,
I could have the time series chart stacked but it shows with much of the horizontal space blank!
Here is the query alternative:

 

index="weather" sourcetype=publicweatherdata (Location=C60*)
| fields _time, Location, Temperature
| eval Date=strftime(_time, "%D")
| eval hour_min=strftime(_time, "%H:%M")
| eval _time = strptime(hour_min, "%H:%M")
| timechart span=30m max(Temperature) AS Temperature BY Date

 

How can I improve the visualization to make time series stacked with x-axis free from the dates?

Below are the charts needing improvement. Thanks!

stacked-but-tiny.png.pngnot-stacked.png.png

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

index="weather" sourcetype=publicweatherdata (Location=C60*)
| fields _time, Location, Temperature
| timechart span=30m max(Temperature) AS Temperature
| timewrap 1d

View solution in original post

yshen
Communicator

Thanks for the perfect solution!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

index="weather" sourcetype=publicweatherdata (Location=C60*)
| fields _time, Location, Temperature
| timechart span=30m max(Temperature) AS Temperature
| timewrap 1d
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...

Customer success is front and center at .conf25

Hi Splunkers, If you are not able to be at .conf25 in person, you can still learn about all the latest news ...