Splunk Search

How to have multiple time series charts of multiple days' temperature measurements during the days stacked for 24 hours

yshen
Communicator


I want to compare the daily temperature measurements at the same period, but different days by a stacked temperature time series for multiple days.
Using timechart I have the following query to organize the data, as the _time value contains the date information, the resulted visualization yields no stacked but one after another.

 

index="weather" sourcetype=publicweatherdata (Location=C60*)
| fields _time, Location, Temperature
| eval Date=strftime(_time, "%D")
| timechart span=30m max(Temperature) AS Temperature BY Date

 

I tried to only retain the hour, minutes in _time, resulting all _time value of the date of 20222-07-06, when I executed the query,
I could have the time series chart stacked but it shows with much of the horizontal space blank!
Here is the query alternative:

 

index="weather" sourcetype=publicweatherdata (Location=C60*)
| fields _time, Location, Temperature
| eval Date=strftime(_time, "%D")
| eval hour_min=strftime(_time, "%H:%M")
| eval _time = strptime(hour_min, "%H:%M")
| timechart span=30m max(Temperature) AS Temperature BY Date

 

How can I improve the visualization to make time series stacked with x-axis free from the dates?

Below are the charts needing improvement. Thanks!

stacked-but-tiny.png.pngnot-stacked.png.png

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

index="weather" sourcetype=publicweatherdata (Location=C60*)
| fields _time, Location, Temperature
| timechart span=30m max(Temperature) AS Temperature
| timewrap 1d

View solution in original post

yshen
Communicator

Thanks for the perfect solution!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

index="weather" sourcetype=publicweatherdata (Location=C60*)
| fields _time, Location, Temperature
| timechart span=30m max(Temperature) AS Temperature
| timewrap 1d
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...