How to display a linechart that uses the same field for different devices?

[thefuzz4]

So I have HomeAssistant installed and I'm sending all of the events off to my splunk server. I recently had my attic insulation increased and I'm having fun charting the differences in the house temp of pre and post install.

So I have this search which returns my house temp

index="homeassistant" sourcetype="homeassistant_event" "attributes.friendly_name"="Whole House Thermostat" | spath | search domain=sensor | rename value as "House Temp"

And then my outside temp

index="homeassistant" sourcetype="homeassistant_event" "attributes.friendly_name"="Dark Sky Temperature" | spath | search entity_id=dark_sky_temperature | rename value as "Outside Temp"

I have to use the spath in order to have it parse the json fields. WIthout the spath it just parses the attributes as fields and not the rest of it. Here is what a typical event looks like

{   [-] 
     attributes:    {   [-] 
         attribution:    Powered by Dark Sky    
         friendly_name:  Dark Sky Temperature   
         icon:   mdi:thermometer    
         unit_of_measurement:    °F    
    }   
     domain:     sensor 
     entity_id:  dark_sky_temperature   
     host:   HASS   
     time:   2019-04-13 17:54:26.698402+00:00   
     value:  31.7   
}

So as you can see the value field gets reused I'm sure that this is a super simple solution to come up with but for the like of me I'm having a heck of a time figuring it out. All I want to do is a timechart with both the values reflected on the chart. I tried using subsearch and appendcols but I don't think that either they apply to my situation or they're the right thing for my situation.

Thank you all for your help with this in advance and if you need more examples of my data let me know.

EDIT: Here is what the Thermostat data looks like

{   [-] 
     attributes:    {   [-] 
         current_temperature:    70 
         fan_list:  [   [+] 
        ]   
         fan_mode:   Auto Low   
         fan_state:  Idle   
         friendly_name:  Heating    
         max_temp:   95 
         min_temp:   45 
         node_id:    70 
         operating_state:    Idle   
         operation_list:    [   [+] 
        ]   
         operation_mode:     heat   
         supported_features:     193    
         temperature:    68 
         value_id:   72057595217625106  
         value_index:    1  
         value_instance:     1  
    }   
     domain:     climate    
     entity_id:  honeywell_unknown_type0011_id0003_heating_1    
     host:   HASS   
     time:   2019-04-13 19:15:58.113817+00:00   
     value:  1  
}

[chrisyounger · Accepted solution]

You need to do something like this to get the value into their own fields:

index="homeassistant" "attributes.friendly_name"="Temperature Upstairs" OR "attributes.friendly_name"="Temperature Downstairs" 
| spath
| rename attributes.friendly_name as fname
| eval temp_up = if(fname=="Temperature Upstairs",value,null()) 
| eval temp_down = if(fname=="Temperature Downstairs",value,null()) 
| timechart bins=800 avg(temp_up) as temp_up avg(temp_down) as temp_down

[thefuzz4]

Thank you very much for that great solution. That is def something I have not done with splunk yet. Great solution.