topic How to create a timeline table? in Splunk Search

How to create a timeline table?

faustf — Wed, 04 Oct 2023 18:03:12 GMT

Hi,
we are logging api requests in Splunk.

I would like to create a sort of health check table where every column represents the status code of the last API call in previous 5 minutes. While each row is a different API.

Here an example of what the output should be

Any Idea how I could achieve that in Splunk?

Each row represents a different API ( request.url), while the status code is stored in response.status

Thank you

Re: Create a timeline table

richgalloway — Sun, 01 Oct 2023 20:40:29 GMT

See if this helps. It uses actual times rather than relative ones, but the format is there.

index=_internal status=* earliest=-30m ``` Get the most recent status for each API every 5 minutes | timechart span=5m latest(status) as status by API ``` Convert timestamp to time (HH:MM) ``` | eval _time=strftime(_time,"%H:%M") ``` Flip the display so time is across the top and API down the side ``` | transpose 0 header_field=_time column_name="API" ``` Fill in blank cells ``` | fillnull value="-"

Re: Create a timeline table

faustf — Wed, 04 Oct 2023 05:52:59 GMT

Very good this is what I was looking for. Thank you.

Do you know how I can now color each cell depending on the status code?

Usually I use the following configuration in the dashboard

<format type="color" field="status"> <colorPalette type="expression">case(value like "5%","#D6563C",value like "4%","#F2B827",value like "3%","#A2CC3E",value like "2%","#65A637",true(),null)</colorPalette> </format>

but it is not working now (I suppose because of the transpose command).

Re: Create a timeline table

richgalloway — Wed, 04 Oct 2023 17:44:24 GMT

I suspect you are right, but you probably should post a separate question about that.