https://community.splunk.com/t5/Dashboards-Visualizations/Tracking-state-changes-for-a-day/m-p/582092#M47695 <P>Here is some background on what I am trying to accomplish, I have 3 separate devices that will be in any of 6 stages of activities throughout a day. I have a base search that will tell when a device changes states, what state it changes to, and what time this occurs. I would like to have a chart or graph that will tell me how long each device was in each state for a given day.&nbsp; I can't put my search or data on the forum.&nbsp;</P> Fri, 21 Jan 2022 21:03:57 GMT jeromehenry906 2022-01-21T21:03:57Z https://community.splunk.com/t5/Dashboards-Visualizations/Tracking-state-changes-for-a-day/m-p/582092#M47695 <P>Here is some background on what I am trying to accomplish, I have 3 separate devices that will be in any of 6 stages of activities throughout a day. I have a base search that will tell when a device changes states, what state it changes to, and what time this occurs. I would like to have a chart or graph that will tell me how long each device was in each state for a given day.&nbsp; I can't put my search or data on the forum.&nbsp;</P> Fri, 21 Jan 2022 21:03:57 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Tracking-state-changes-for-a-day/m-p/582092#M47695 jeromehenry906 2022-01-21T21:03:57Z https://community.splunk.com/t5/Dashboards-Visualizations/Tracking-state-changes-for-a-day/m-p/582105#M47696 <P>If your looking at 1 device at a time, given that you have a table like &nbsp;"_time_of_change | previous_state | new_state " you can use the "| delta&nbsp;_time_of_change" command to calculate the duration of the previous_state. Make sure you use the time as epoch.<BR /><BR /></P><P>&nbsp;<BR /><BR /></P> Sat, 22 Jan 2022 01:04:34 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Tracking-state-changes-for-a-day/m-p/582105#M47696 diogofgm 2022-01-22T01:04:34Z