Splunk Search

How to have multiple time series charts of multiple days' temperature measurements during the days stacked for 24 hours

yshen
Communicator


I want to compare the daily temperature measurements at the same period, but different days by a stacked temperature time series for multiple days.
Using timechart I have the following query to organize the data, as the _time value contains the date information, the resulted visualization yields no stacked but one after another.

 

index="weather" sourcetype=publicweatherdata (Location=C60*)
| fields _time, Location, Temperature
| eval Date=strftime(_time, "%D")
| timechart span=30m max(Temperature) AS Temperature BY Date

 

I tried to only retain the hour, minutes in _time, resulting all _time value of the date of 20222-07-06, when I executed the query,
I could have the time series chart stacked but it shows with much of the horizontal space blank!
Here is the query alternative:

 

index="weather" sourcetype=publicweatherdata (Location=C60*)
| fields _time, Location, Temperature
| eval Date=strftime(_time, "%D")
| eval hour_min=strftime(_time, "%H:%M")
| eval _time = strptime(hour_min, "%H:%M")
| timechart span=30m max(Temperature) AS Temperature BY Date

 

How can I improve the visualization to make time series stacked with x-axis free from the dates?

Below are the charts needing improvement. Thanks!

stacked-but-tiny.png.pngnot-stacked.png.png

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

index="weather" sourcetype=publicweatherdata (Location=C60*)
| fields _time, Location, Temperature
| timechart span=30m max(Temperature) AS Temperature
| timewrap 1d

View solution in original post

yshen
Communicator

Thanks for the perfect solution!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

index="weather" sourcetype=publicweatherdata (Location=C60*)
| fields _time, Location, Temperature
| timechart span=30m max(Temperature) AS Temperature
| timewrap 1d
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...