topic How to use the existence of a preceding event in timechart? in Splunk Search

How to use the existence of a preceding event in timechart?

pm771 — Tue, 11 Aug 2020 23:20:35 GMT

I have an index where each event has unique EventID and Status fields.

Each event is progressing through multiple interim statuses until it reaches one of the two terminal statuses: SUCCESS or FAILURE. Each event goes through a subset of all possible interim statuses.

I'm trying to build a timechart that would show two counts: All Failed Events and Failed Events with a certain Interim Status.

One of the problems is that a preceding interim event could be outside of the span interval.

I was thinking something along these lines (not necessarily syntactically correct):

index=... sourcetype=... Status IN ("FAILURE", "INTERIM") | timechart span=5m count by EventId | untable _time eventCount | stats count as "All" count(eval(EventCount==2)) as "With Interim" by _time

Re: How to use the existence of a preceding event in timechart?

to4kawa — Tue, 11 Aug 2020 23:40:22 GMT

index=... sourcetype=... Status IN ("FAILURE", "INTERIM") | stats min(eval(if(Status="INTERIM",_time,NULL))) as Interim min(eval(if(Status="FAILURE",_time,NULL))) as Failure by EventId | eval Interim_EventID=if(isnotnull(Interim),EventID,NULL) | eval time=mvappend(Interim,Failure) | mvexpand time | rename time as _time | table _time EventId Interim_EventID | sort _time

and
| timechart span=5m count(EventId) count(Interim_EventID)

Re: How to use the existence of a preceding event in timechart?

pm771 — Wed, 12 Aug 2020 02:49:19 GMT

@to4kawa ,

Thank you. It works.

Since I'm dealing with relatively large data sets I stumbled into 10,000 limit on sort.

So, I used sort 0 _time.