Splunk Search

No Visualisation although enough values

ToniSchulz
Explorer

Hello everyone,

I have a strange problem. I want to visualize two different temperatures over the time and wrote the following search query:

index=1_Scheibenkleben sourcetype=1_Scheibenkleben_csv Raumtemperatur=* OR Scheibentemperatur=*|chart list(Raumtemperatur) as RT, list(Scheibentemperatur) as ST over _time span=1d

The table that I get looks like this:

_time                       RT                                   ST
2015-01-01                  17,6
                            16,5
                            16,6
2015-01-02                  16,8                                22,6
                            16,9                                20,6
                                                                21
                            17                                  18
2015-01-03        etc.....  

For this combination I don´t get a visualisation to work. The values in the chart are 0 although they are listed further down. When I directly use the chart command the same happens. It seems that the problem is, that for some time stamps the value for e.g. Scheibentemperatur ist 0 although the =* command. We used that command because some entrys don´t have values and this made us sure to not have too many of them. I also tried different spans and different time ranges, but no results.

Does anyone have an idea why that is?

Thanks a lot in advance!

ToniSchulz
Explorer

Hi stephanefotso,

thanks for your answer! I tried that out, unfortunatly it did not change anything.
Could there be other reasons?

0 Karma

stephanefotso
Motivator

I think your query need parenthesis. try this:

index=1_Scheibenkleben sourcetype=1_Scheibenkleben_csv  (Raumtemperatur=* OR Scheibentemperatur=*)|chart list(Raumtemperatur) as RT, list(Scheibentemperatur) as ST over _time span=1d
SGF
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...