https://community.splunk.com/t5/Getting-Data-In/How-can-I-take-multiple-fields-and-time-values-and-combine-them/m-p/431347#M75473 <P>Suppose I have 4 fields </P> <P>fields= "jobtype" values= A,B<BR /> fields= "status" values=1,2,3,4,5,6<BR /> fields= "Time1" values=.....................<BR /> fields= "Time2" values=.....................</P> <P>I want to create a full day timestamp using the fields I have </P> <P>(example)</P> <PRE><CODE>Step 1 = jobtype=A ,status=1 **earliest of Time1** Step 2 = jobtype=A ,status=1 **latest of Time1** Step 3 = jobtype=A, status=2 Or status=3 **earliest of Time2** Step 4 = jobtype=A, status=2 Or status=4 **latest of Time2** Step 5 = jobtype=B, status=5 **earliest of Time2** Step 6 = jobtype=A, status=6 **earliest of Time2** </CODE></PRE> <P>Result would look something like this on one sheet</P> <P>Step1---------- Step2------------ Step3--------- Step4------------ Step5---------- Step6 </P> <P>min(Time1) ---max( Time1)---min(Time2)-- max(Time2)----min(Time2)---min(Time2)</P> <P>Because There is multiple fields and values involved, I cannot seem to get the right answer. Please help me</P> Fri, 07 Dec 2018 15:48:57 GMT hyungjoon 2018-12-07T15:48:57Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-take-multiple-fields-and-time-values-and-combine-them/m-p/431347#M75473 <P>Suppose I have 4 fields </P> <P>fields= "jobtype" values= A,B<BR /> fields= "status" values=1,2,3,4,5,6<BR /> fields= "Time1" values=.....................<BR /> fields= "Time2" values=.....................</P> <P>I want to create a full day timestamp using the fields I have </P> <P>(example)</P> <PRE><CODE>Step 1 = jobtype=A ,status=1 **earliest of Time1** Step 2 = jobtype=A ,status=1 **latest of Time1** Step 3 = jobtype=A, status=2 Or status=3 **earliest of Time2** Step 4 = jobtype=A, status=2 Or status=4 **latest of Time2** Step 5 = jobtype=B, status=5 **earliest of Time2** Step 6 = jobtype=A, status=6 **earliest of Time2** </CODE></PRE> <P>Result would look something like this on one sheet</P> <P>Step1---------- Step2------------ Step3--------- Step4------------ Step5---------- Step6 </P> <P>min(Time1) ---max( Time1)---min(Time2)-- max(Time2)----min(Time2)---min(Time2)</P> <P>Because There is multiple fields and values involved, I cannot seem to get the right answer. Please help me</P> Fri, 07 Dec 2018 15:48:57 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-take-multiple-fields-and-time-values-and-combine-them/m-p/431347#M75473 hyungjoon 2018-12-07T15:48:57Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-take-multiple-fields-and-time-values-and-combine-them/m-p/431348#M75474 <P>Something like this? also it helps if you can share some mockup data or build it with makeresults . The only line below you should care about is xyseries I suspect. you may need a stats for this "max" requirement</P> <P>| makeresults count=2 <BR /> | streamstats count as count <BR /> | eval time=case(count=2,relative_time(now(),"+2d"),count=1,now()) <BR /> | makecontinuous time span=15m <BR /> | eval _time=time<BR /> | eval job=if( random()%2==1,"JobA","JobB")<BR /> | streamstats count by job reset_on_change=true <BR /> | xyseries count, job, _time</P> <P>Alternatively you may mean (you only care about the |Stats and |xyseries parts )</P> <P>| makeresults count=2 <BR /> | streamstats count as count <BR /> | eval time=case(count=2,relative_time(now(),"+2d"),count=1,now()) <BR /> | makecontinuous time span=15m <BR /> | eval _time=time <BR /> | eval job=if( random()%2==1,"JobA","JobB") <BR /> | streamstats count by job reset_on_change=true <BR /> | stats max(_time) by count, job<BR /> | xyseries job, count, max(_time)</P> Tue, 29 Sep 2020 22:19:06 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-take-multiple-fields-and-time-values-and-combine-them/m-p/431348#M75474 astein_splunk 2020-09-29T22:19:06Z