Splunk Search

One search to create multiple line chart

sbnoobbb
Path Finder

Is there any way that we can use a search to create multiple line chart? against the time? I set an interval on 300 seconds and against time, what is the best search commands that we can use ?

time : 1371459878
visibility : 1.73
windBearing : 197
windSpeed : 8.97
cloudCover : 0.97
dewPoint : 70.9
humidity : 0.55
icon : cloudy
ozone : 264.25
precipIntensity : 0
pressure : 1004.23
summary : Overcast
temperature : 90.46

1 Solution

kristian_kolb
Ultra Champion

Assuming that you have the fields already extracted, this is one way of doing it. In this case we're charting by _time, which along with first() will work more as a plotting command than an aggregation command, given that there is only one event per _time.

your_base_search | chart first(visibility) first(dewPoint) first(temperature) first(ozone) by _time

You can also use timechart span=xxx stats_command(field) stats_command(field)

http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/CommonStatsFunctions

Hope this helps,

Kristian

View solution in original post

kristian_kolb
Ultra Champion

Assuming that you have the fields already extracted, this is one way of doing it. In this case we're charting by _time, which along with first() will work more as a plotting command than an aggregation command, given that there is only one event per _time.

your_base_search | chart first(visibility) first(dewPoint) first(temperature) first(ozone) by _time

You can also use timechart span=xxx stats_command(field) stats_command(field)

http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/CommonStatsFunctions

Hope this helps,

Kristian

sbnoobbb
Path Finder

Thanks !!!

0 Karma

kristian_kolb
Ultra Champion

if you want to use min/max/avg you might want to bucket _time, or use the timechart. Otherwise the values will be the same (guessing you have one event per _time).

Use timechart span=XXX max(Y) avg(Y) min(Y) max(Z) avg(Z) etc, where the span is long enough to ensure that several events get included in the time-slot.

sbnoobbb
Path Finder

Given search below, do you have any guidance to improve my search ?

sourcetype="NYPWeatherForecastCurrently" | chart first(current_temperature) max(current_temperature) avg(current_temperature) min(current_temperature) first(current_psi) first(current_humidity) first(current_dewpoint) first(current_visibility) first(current_windSpeed) by _time

time : 1371697655
visibility : 0.3
windBearing : 247
windSpeed : 7.16
psiAverage : 162
cloudCover : 0.38
dewPoint : 72.24
humidity : 0.57
icon : fog
ozone : 268.3
precipIntensity : 0
pressure : 1007.63
summary : Foggy
temperature : 89.95

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...