Combining multiples searches into a trellis layout of single value visualizations

1.1k Views Asked by At

I have a number of networked devices that I am pulling temperature and humidity data from and ingesting into Splunk. Each device is located in a physical location and most, but not all have two sensors.

The perfect panel for my needs is one that uses Single Value visualizations to show the current temperature from all sensors in all locations. I can create two different panels using the following queries, but I'm trying to figure out if it is possible to combine them to create a single dashboard panel.

index="climate" | timechart latest(s1_temp) as "S1_Temp" by location

and

index="climate" | timechart latest(s2_temp) as "S2_Temp" by location
<panel>
      <single>
        <search>
          <query>index="climate" | timechart latest(s1_temp) as "S1_Temp" by location</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0.00</option>
        <option name="rangeColors">["0xdc4e41","0xf8be34","0x53a051","0xf8be34","0xdc4e41"]</option>
        <option name="rangeValues">[67,69,85,87]</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">1</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="trendInterval">-24h</option>
        <option name="unit">°</option>
        <option name="unitPosition">after</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>

While I could display the data easily enough using a column chart, the single value with colors and sparkline is perfect for my use case. I've tried a lot of things, but haven't managed to figure it out yet. I figure at this point the answer is either embarrassingly easy or impossible.

1

There are 1 best solutions below

0
On

While I'm still trying to figure out some minor details, I did eventually find some documentation that helped me get the output I was looking for. The following query essentially combines the two data series and allows me to create the trellis panel by creating a new field to create a new, unique mashup of location and sensor.

index="climate" 
  | bin _time span=5m 
  | stats latest(s1_temp) as "S1", latest(s2_temp) as "S2" by _time,location 
  | eval reading="S1 S2" 
  | makemv reading 
  | mvexpand reading 
  | eval Temp=case(reading=="S1",S1,reading=="S2",S2) 
  | eval Series=location+"-"+reading 
  | timechart latest(Temp) by Series

The answer to my problem was actually in the official documentation under Chart Multiple Data Series. I simply wasn't asking the right questions when I searched the documentation. Hopefully, someone finds this useful.

If there is a more efficient way of doing this, I haven't found it yet.