I have a strange problem. I want to visualize two different temperatures over the time and wrote the following search query:
index=1_Scheibenkleben sourcetype=1_Scheibenkleben_csv Raumtemperatur=* OR Scheibentemperatur=*|chart list(Raumtemperatur) as RT, list(Scheibentemperatur) as ST over _time span=1d
The table that I get looks like this:
_time RT ST 2015-01-01 17,6 16,5 16,6 2015-01-02 16,8 22,6 16,9 20,6 21 17 18 2015-01-03 etc.....
For this combination I don´t get a visualisation to work. The values in the chart are 0 although they are listed further down. When I directly use the chart command the same happens. It seems that the problem is, that for some time stamps the value for e.g. Scheibentemperatur ist 0 although the =* command. We used that command because some entrys don´t have values and this made us sure to not have too many of them. I also tried different spans and different time ranges, but no results.
Does anyone have an idea why that is?
Thanks a lot in advance!
I think your query need parenthesis. try this:
index=1_Scheibenkleben sourcetype=1_Scheibenkleben_csv (Raumtemperatur=* OR Scheibentemperatur=*)|chart list(Raumtemperatur) as RT, list(Scheibentemperatur) as ST over _time span=1d