Convert point in time events to timeseries with Data points

SplunkNs231 — Thu, 28 Oct 2021 16:51:26 GMT

I have the following data. That I am trying to convert to a time series by Type with the last Status brought forward.

Raw data:

Timestamp	Status	Type
10/28/2021 12:00	down	B
10/28/2021 12:10	up	A
10/28/2021 12:30	up	B
10/28/2021 13:10	down	B
10/28/2021 13:30	up	B

After transformation I need a data point every 10 minutes for each Type with the pervious Status brought forward. Note I could have 40-50 different types.

Example Transformation:

Timestamp	Status	Type
10/28/2021 12:00	down	B
10/28/2021 12:10	down	B
10/28/2021 12:20	down	B
10/28/2021 12:30	up	B
*10/28/2021 12:40*	up	B
*10/28/2021 12:50*	up	B
*10/28/2021 13:00*	up	B
10/28/2021 13:10	down	B
10/28/2021 13:20	down	B
10/28/2021 13:30	up	B
*10/28/2021 13:40*	up	B

Any Ideas?

Re: Convert point in time events to timeseries with Data points

PickleRick — Thu, 28 Oct 2021 19:46:11 GMT

<your search> | timechart span=10m last(status) by Type | filldown | untable _time Type Status

Mind you that you might not get values at the beginning since you don't have any initial value.

Of course you might want to | sort at the end to your liking.

topic Convert point in time events to timeseries with Data points in Splunk Search

Convert point in time events to timeseries with Data points

Re: Convert point in time events to timeseries with Data points