I have a tiny table of data that I want to display as a reference on a dashboard - something like:
date | val1 | val2
9/16/2020 | 10 | 12
9/17/2020 | 11 | 14
9/18/2020 | 12 | 13
that I want to display as a line chart:
I found this very convoluted way to construct it:
| makeresults
| eval testDay="9/16/2020"
| eval testVal1=10
| eval testVal2=12
| append
[| makeresults
| eval testDay="9/17/2020"
| eval testVal1=11
| eval testVal2=14
]
| append
[| makeresults
| eval testDay="9/18/2020"
| eval testVal1=12
| eval testVal2=13
]
| chart first(testVal1), first(testVal2) over testDay
is there a simpler way? Perhaps something more like my little tabular syntax in the table at the beginning of the post? Or at least more like:
val1 = [10,11,12]
There is a simpler way. It's what I use to produce test data when answering questions about Splunk.
| makeresults
| eval _raw="date val1 val2
9/16/2020 10 12
9/17/2020 11 14
9/18-2020 12 13"
| multikv forceheader=1
| chart values(val1) as val1, values(val2) as val2 by date
It's important for mutlikv to work properly that the header and data line up vertically.
The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.