Splunk Search

How to create a chart based on condition

balajsoz
Path Finder

Hi,

Am having the data contains below;
Asset Time stamp Temperature
LD-02 00:12.6 43 41

HT-02 00:26.3 45 59

GR-02 00:33.6 52 42

LD-02 00:57.8 47 79

This are few examples of my data(actually am having 5000 rows of same kind of data for different assests) and from this i need to make a timechart which should display a trend for each Asset what is the temperature value.
pls help to find how to filter particular set of assets with its temperature

Tags (1)
0 Karma

sideview
SplunkTrust
SplunkTrust

If you only have a couple Asset values, and assuming that the timestamp extraction was set up properly when the data input was set up, you can just do

<your search terms> | timechart avg(Temperature) by Asset

On the other hand if you have a very large number of Asset values, you probably want to build some kind of search or filtering UI so that the user can narrow down the kind of assets that they want to see.

I've actually built an interface called 'Explore' as one of the Sample interfaces in Sideview Utils, and you might take a look at that because it's designed for data just like this -- reams and reams of points, like SCADA data or data from various automation technologies. You configure the 'Explore' interface just by setting a couple macros. So although it ships in Sideview Utils with those macros set so that it lets you 'explore' Splunk's internal metrics data, you can set those macros yourself so as to retarget the entire Explore interface over to your own custom data. In the end the users can click and browse and filter around in the hierarchy of the SCADA infrastructure that you have, generating reports on the fly and drilling down for more detail whenever they like. http://sideviewapps.com/apps/sideview-utils

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...