I am using query as below
index="test" sourcetype="reports"
| bin _time span=1m | stats values(a) as a values(b) as b values(c) as c values(d) as d values(e) as e values(f) as f values(g) as g by par1, _time
| append [search (index="test" sourcetype=reports_metadata) | table par1,par2,par3,par4,par5,par6,par7,par8,par9,par10,par11,par12]
| eventstats values(par2) as par2,values(par3) as par3, values(par4) as par4, values(par5) as par5, values(par6) as par6, values(par7) as par7, values(par8) as par8,values(par9) as par9,values(par10) as par10,values(par11) as par11,values(par12) as par12, values(a) as a alues(b) as b values(c) as c values(d) as d values(e) as e values(f) as f values(g) as g by par1
| search par2 IN ("*") par3 IN ("*") par3 IN ("*") par4 ("*") par5 IN ("*") par6 IN ("*") par7 IN ("*") par8 IN ("*") par9 IN ("*") par10 IN ("*")
| search par1="*"ar2 IN ("*") par3 IN ("*") par3 IN ("*") par4 ("*") par5 IN ("*") par6 IN ("*") par7 IN ("*") par8 IN ("*") par9 IN ("*") par10 IN ("*") par11 IN ("*") par12 IN ("*")
| timechart span=15m values(a) by par1 limit=0
In this query, I am able to use any values rangin from a to g and plot a time series graph.
I need help in plotting time series for one or more values and also how this value can be used to pick from a drop down filter
#timeseries #timechart #xyseries #multiseries #multivalue
Report data would be as below
par1 | time | b | e | f | g | l | m | n | r | s |
SNC1 | 12/5/2024 16:30 | 299367 | -7.7 | -7.9 | -7.7 | 1.00E-37 | 1.00E-37 | 1.80E-07 | 13.93 | 12.91 |
SNC1 | 12/5/2024 16:45 | 299364 | -7.7 | -7.9 | -7.7 | 1.00E-37 | 1.00E-37 | 1.80E-07 | 13.95 | 12.87 |
SNC1 | 12/5/2024 17:00 | 299369 | -7.7 | -7.9 | -7.7 | 1.00E-37 | 1.00E-37 | 1.90E-07 | 13.89 | 12.88 |
SNC1 | 12/5/2024 17:15 | 299364 | -7.6 | -7.9 | -7.7 | 1.00E-37 | 1.00E-37 | 1.80E-07 | 13.92 | 12.89 |
SNC1 | 12/5/2024 17:30 | 299368 | -7.6 | -7.9 | -7.7 | 1.00E-37 | 1.00E-37 | 1.90E-07 | 13.87 | 12.83 |
SNC1 | 12/5/2024 17:45 | 299362 | -7.6 | -7.9 | -7.7 | 1.00E-37 | 1.00E-37 | 1.90E-07 | 13.92 | 12.78 |
SNC1 | 12/5/2024 18:00 | 299368 | -7.6 | -7.9 | -7.7 | 1.00E-37 | 1.00E-37 | 1.80E-07 | 13.92 | 12.88 |
SNC1 | 12/5/2024 18:15 | 299371 | -7.7 | -7.9 | -7.7 | 1.00E-37 | 1.00E-37 | 1.80E-07 | 13.95 | 12.88 |
SNC1 | 12/5/2024 18:30 | 299359 | -7.7 | -7.9 | -7.7 | 1.00E-37 | 1.00E-37 | 1.80E-07 | 13.94 | 12.83 |
SNC1 | 12/5/2024 18:45 | 299362 | -7.7 | -7.9 | -7.7 | 1.00E-37 | 1.00E-37 | 1.80E-07 | 13.92 | 12.86 |
SNC1 | 12/5/2024 19:00 | 299369 | -7.7 | -7.9 | -7.7 | 1.00E-37 | 1.00E-37 | 1.90E-07 | 13.89 | 12.85 |
SNC1 | 12/5/2024 19:15 | 299365 | -7.7 | -7.9 | -7.7 | 1.00E-37 | 1.00E-37 | 1.90E-07 | 13.92 | 12.89 |
SNC1 | 12/5/2024 19:30 | 299368 | -7.6 | -7.9 | -7.7 | 1.00E-37 | 1.00E-37 | 1.80E-07 | 13.9 | 12.75 |
SNC1 | 12/5/2024 19:45 | 299369 | -7.7 | -7.9 | -7.7 | 1.00E-37 | 1.00E-37 | 1.90E-07 | 13.92 | 12.85 |
SNC1 | 12/5/2024 20:00 | 299363 | -7.7 | -7.9 | -7.7 | 1.00E-37 | 1.00E-37 | 1.90E-07 | 13.93 | 12.89 |
SNC1 | 12/5/2024 20:15 | 299358 | -7.7 | -7.9 | -7.7 | 1.00E-37 | 1.00E-37 | 1.90E-07 | 13.93 | 12.85 |
SNC2 | 12/5/2024 16:30 | 259482 | -7.6 | -6.9 | -7.6 | 9.00E-35 | 1.00E-34 | 0.0011 | 9.58 | 9.54 |
SNC2 | 12/5/2024 16:45 | 259479 | -7.5 | -6.9 | -7.6 | 8.00E-35 | 1.00E-34 | 0.0011 | 9.59 | 9.53 |
SNC2 | 12/5/2024 17:00 | 259478 | -7.5 | -6.9 | -7.6 | 8.00E-35 | 1.00E-34 | 0.0011 | 9.59 | 9.56 |
SNC2 | 12/5/2024 17:15 | 259484 | -7.5 | -6.9 | -7.6 | 5.00E-35 | 1.00E-34 | 0.0011 | 9.61 | 9.55 |
SNC2 | 12/5/2024 17:30 | 259487 | -7.6 | -6.9 | -7.6 | 6.00E-35 | 2.00E-34 | 0.0011 | 9.56 | 9.52 |
SNC2 | 12/5/2024 17:45 | 259480 | -7.5 | -6.9 | -7.6 | 8.00E-35 | 1.00E-34 | 0.0011 | 9.57 | 9.53 |
Attached sample data of two tables. for each SNC1, SNC2, there will be data for each 15 mins and values can be different. Now the idea is to do timeseries for each SNC any of the values and filtering will be mainly based on SNC and any of the values (one or more values at the same time )
reports_metadata file contains data as below
snc_label | deployment_state | par1 | par2 | par3 | par4 | par5 | par6 | par7 | par8 | par9 | par10 | par11 | par12 | par13 | par14 | par15 | par16 | par17 | par18 | par19 |
SNC1 | discovered | L0CP | C4 | 100 | 37.5 | ABC | MOTR | ABC-0101 | XYZ-0101 | 1-1-1 | 15-7-1 | 15.5 | -23.697888 | 133.879791 | A | B | AA | |||
SNC2 | discovered | NL0CP | C4 | 200 | 37.5 | DCE | OTR | DCE-0102 | CSNO-0101 | 7-8-1 | 10-2-2 | 15.5 | 15.5 | -30.296649 | 153.113164 | -28.864117 | 153.047084 | B | B | AB |
SNC3 | discovered | L0CP | C74 | 300 | 37.5 | XYZ | MOTR | ABC-0101 | PTMA-0101 | 15-7-1 | 15-7-1 | 15.5 | 15.5 | -30.296649 | 153.113164 | -31.431357 | 152.914377 | A | A | AD |
SNC4 | discovered | NL0CP | C64 | 100 | 37.5 | ABC | MOTR | DCE-0102 | BRDE-0102 | 15-7-1 | 10-2-2 | 15.5 | 15.5 | -27.357494 | 153.022632 | -27.471961 | 153.025407 | C | C | CA |
SNC5 | discovered | L0CP | C44 | 200 | 37.5 | ABB | MOTR | CZWX-0201 | HABC-0101 | 10-2-2 | 1-1-1 | 15.5 | 15.5 | -33.797823 | 151.180644 | -33.896447 | 151.193881 | D | E | DZ |
Hi @R_Ramanan,
Can you provide a small set of sample data? If a, b, c, ..., g are only related to par2, par3, par4, ..., par12 by par1, then par1 is likely your only filterable parameter.
@tscroggins, hope the information is helpful, please let me know if you need any additional details