topic Re: charting state as sequence of values in time in Splunk Search

charting state as sequence of values in time

idsiano — Wed, 10 Dec 2014 22:23:16 GMT

I have a log that contains a polling state of a device, PLUGGED/UNPLUGGED, logged every 10 s.
I want to chart a timeline in which each state is a point and y values are: PLUGGED=1,UNPLUGGED=0 so I can view the state of the device over the timespan.
How I get this?

Re: charting state as sequence of values in time

lguinn2 — Wed, 10 Dec 2014 22:46:02 GMT

It is always nice to see an excerpt of the log, but I will hazard a guess

yoursearchhere
| eval status=if(match(_raw,"UNPLUGGED"),0,1)
| timechart span=10s avg(status)

You will not be able to show a very large timespan in a single chart, but this should work. It would be nicer if you had a field that contained the status, but that isn't necessary.

UPDATE: sorry, that was a dumb mistake on my part. I have updated the proposed solution to use avg(status) instead of just status. You could actually use almost any of the functions: first, last, avg - since there should only be one event in any 10 second period. But don't be surprised if you see two events (or zero events) in a time period; things are rarely perfect all the time...

Re: charting state as sequence of values in time

idsiano — Thu, 11 Dec 2014 07:55:25 GMT

I got the results with this :

index = hcd2 source="/algorithm/logs/debug.log" Plug_state 
| eval status=if(match(Plug_state,"EV_UNPLUGGED"),0,1) 
| timechart span=5s avg(status)

The problem is that timechart need an aggregation function, the only one that returns values similar to the discrete 0 and 1 is avg.