How to create a dashboard that will convert a heading value to display a compass visualization?

[adriangrassi]

Hello guys, I am creating a dashboard for my electric car and I want to take the a heading value and convert to a directional value/compass visualization.

For example
heading of 360 up to 11 degrees would be North
http://climate.umn.edu/snow_fence/components/winddirectionanddegreeswithouttable3.htm

I haven't been able to find an example of this as it relates to Splunk.

Here is my data below

avg(heading)
2017-02-09 09:58:00 98.000000
2017-02-09 10:00:00 81.000000
2017-02-09 10:02:00 360.000000
2017-02-09 10:04:00 86.000000
2017-02-09 10:06:00 114.000000
2017-02-09 10:08:00 294.000000

Any suggestions? Thank you so much for any help.

[somesoni2 · Accepted solution]

Not sure about the compass visualization but you can convert a heading value to the Text (based on the link you shared) using a case statement. You can also, convert the giant case to a macro.

your current search giving fields _time, avg(heading) 
| eval Direction=case('avg(heading)'>=348.75 AND 'avg(heading)'<11.25,"N",
'avg(heading)'>=11.25 AND 'avg(heading)'<33.75,"NNE",
'avg(heading)'>=33.75 AND 'avg(heading)'<56.25,"NE",
'avg(heading)'>=56.25 AND 'avg(heading)'<78.75,"ENE",
'avg(heading)'>=78.75 AND 'avg(heading)'<101.25,"E",
'avg(heading)'>=101.25 AND 'avg(heading)'<123.75,"ESE",
'avg(heading)'>=123.75 AND 'avg(heading)'<146.25,"SE",
'avg(heading)'>=146.25 AND 'avg(heading)'<168.75,"SSE",
'avg(heading)'>=168.75 AND 'avg(heading)'<191.25,"S",
'avg(heading)'>=191.25 AND 'avg(heading)'<213.75,"SSW",
'avg(heading)'>=213.75 AND 'avg(heading)'<236.25,"SW",
'avg(heading)'>=236.25 AND 'avg(heading)'<258.75,"WSW",
'avg(heading)'>=258.75 AND 'avg(heading)'<281.25,"W",
'avg(heading)'>=281.25 AND 'avg(heading)'<303.75,"WNW",
'avg(heading)'>=303.75 AND 'avg(heading)'<326.25,"NW",
'avg(heading)'>=326.25 AND 'avg(heading)'<348.75,"NNW",1=1,"Undefined")

[adriangrassi]

@somesoni2, this is wonderful thank you so much for your help. One small problem, this line doesn't seem to work 'avg(heading)'>=348.75 AND 'avg(heading)'<11.25,"N" - currently anything above 348.75 up to 11.25 is seen as undefined.

I was able to get it to recognize up to 360 but not from 0 until 11.25 as North. Here is how I changed for this.

index="tesla" | timechart span=2m avg(heading) usenull=f | eval Direction=case('avg(heading)'>=348.75 AND 'avg(heading)'<11.25,"N",
 'avg(heading)'>=11.25 AND 'avg(heading)'<33.75,"NNE",
 'avg(heading)'>=33.75 AND 'avg(heading)'<56.25,"NE",
 'avg(heading)'>=56.25 AND 'avg(heading)'<78.75,"ENE",
 'avg(heading)'>=78.75 AND 'avg(heading)'<101.25,"E",
 'avg(heading)'>=101.25 AND 'avg(heading)'<123.75,"ESE",
 'avg(heading)'>=123.75 AND 'avg(heading)'<146.25,"SE",
 'avg(heading)'>=146.25 AND 'avg(heading)'<168.75,"SSE",
 'avg(heading)'>=168.75 AND 'avg(heading)'<191.25,"S",
 'avg(heading)'>=191.25 AND 'avg(heading)'<213.75,"SSW",
 'avg(heading)'>=213.75 AND 'avg(heading)'<236.25,"SW",
 'avg(heading)'>=236.25 AND 'avg(heading)'<258.75,"WSW",
 'avg(heading)'>=258.75 AND 'avg(heading)'<281.25,"W",
 'avg(heading)'>=281.25 AND 'avg(heading)'<303.75,"WNW",
 'avg(heading)'>=303.75 AND 'avg(heading)'<326.25,"NW",
 'avg(heading)'>=326.25 AND 'avg(heading)'<348.75,"NNW", 
 'avg(heading)'>=348.76 AND 'avg(heading)'<360.00,"N") 
| fields Direction 

Update - I think I fixed it:

index="tesla" | timechart span=2m avg(heading) usenull=f 
| eval Direction=case('avg(heading)'>=0.00 AND 'avg(heading)'<11.25,"N",
'avg(heading)'>=11.25 AND 'avg(heading)'<33.75,"NNE",
'avg(heading)'>=33.75 AND 'avg(heading)'<56.25,"NE",
'avg(heading)'>=56.25 AND 'avg(heading)'<78.75,"ENE",
'avg(heading)'>=78.75 AND 'avg(heading)'<101.25,"E",
'avg(heading)'>=101.25 AND 'avg(heading)'<123.75,"ESE",
'avg(heading)'>=123.75 AND 'avg(heading)'<146.25,"SE",
'avg(heading)'>=146.25 AND 'avg(heading)'<168.75,"SSE",
'avg(heading)'>=168.75 AND 'avg(heading)'<191.25,"S",
'avg(heading)'>=191.25 AND 'avg(heading)'<213.75,"SSW",
'avg(heading)'>=213.75 AND 'avg(heading)'<236.25,"SW",
'avg(heading)'>=236.25 AND 'avg(heading)'<258.75,"WSW",
'avg(heading)'>=258.75 AND 'avg(heading)'<281.25,"W",
'avg(heading)'>=281.25 AND 'avg(heading)'<303.75,"WNW",
'avg(heading)'>=303.75 AND 'avg(heading)'<326.25,"NW",
'avg(heading)'>=326.25 AND 'avg(heading)'<348.75,"NNW", 
'avg(heading)'>=348.76 AND 'avg(heading)'<360.01,"N") | fields Direction

[aaraneta_splunk]

@adriangrassi - Did the answer provided by somesoni2 help provide the basis to the solution you found? If yes, let me know and I can convert it to an Answer and close out your question. I'll also provide up-votes to you two 🙂

[adriangrassi]

Yes, please mark this as resolved as Somesoni2 answered my question. Thank you so much.