Splunk Search

How to have multiple time series charts of multiple days' temperature measurements during the days stacked for 24 hours

yshen
Communicator


I want to compare the daily temperature measurements at the same period, but different days by a stacked temperature time series for multiple days.
Using timechart I have the following query to organize the data, as the _time value contains the date information, the resulted visualization yields no stacked but one after another.

 

index="weather" sourcetype=publicweatherdata (Location=C60*)
| fields _time, Location, Temperature
| eval Date=strftime(_time, "%D")
| timechart span=30m max(Temperature) AS Temperature BY Date

 

I tried to only retain the hour, minutes in _time, resulting all _time value of the date of 20222-07-06, when I executed the query,
I could have the time series chart stacked but it shows with much of the horizontal space blank!
Here is the query alternative:

 

index="weather" sourcetype=publicweatherdata (Location=C60*)
| fields _time, Location, Temperature
| eval Date=strftime(_time, "%D")
| eval hour_min=strftime(_time, "%H:%M")
| eval _time = strptime(hour_min, "%H:%M")
| timechart span=30m max(Temperature) AS Temperature BY Date

 

How can I improve the visualization to make time series stacked with x-axis free from the dates?

Below are the charts needing improvement. Thanks!

stacked-but-tiny.png.pngnot-stacked.png.png

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

index="weather" sourcetype=publicweatherdata (Location=C60*)
| fields _time, Location, Temperature
| timechart span=30m max(Temperature) AS Temperature
| timewrap 1d

View solution in original post

yshen
Communicator

Thanks for the perfect solution!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

index="weather" sourcetype=publicweatherdata (Location=C60*)
| fields _time, Location, Temperature
| timechart span=30m max(Temperature) AS Temperature
| timewrap 1d
Get Updates on the Splunk Community!

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...