All Apps and Add-ons

Dashboard monitoring: Is there a way to check what the last message was when no event existed at a given time frame?

pratapak
Explorer

Hi,

Is there a way to check what the last message was when no event existed at a given time frame?

Problem statement:
I am creating a widget to display connection status. If connection is successful, I'm displaying "0" and for failed connection I'm displaying "1" , and it's working fine

Log message:

11:30:15.623 AM logger:  com.nsc.ingestion.hono.receiver.HonoReceiver   
     message:    2018-09-22T11:30:15,622+0000 comp=hub-lora-ingestor-0 [vert.x-eventloop-thread-0] INFO  com.bosch.iot.deepfield.ingestion.hono.receiver.HonoReceiver - Connected successfully, creating telemetry consumer ...

11:20:15.127 AM logger:  com.nsc.ingestion.hono.receiver.HonoReceiver   
     message:    2018-09-22T11:30:15,127+0000 comp=hub-lora-ingestor-0 [vert.x-eventloop-thread-0] INFO  com.bosch.iot.deepfield.ingestion.hono.receiver.HonoReceiver - Connecting ...

My search query

(index="05c48b55-c9aa-4743-aa4b-c0ec618691dd"  ( "Connecting ..." OR "Connected successfully, creating telemetry consumer ...")) 
| rex field=_raw "-\s(?<status_message>.*)" 
| eval status=if(like(status_message,"%Connected successfully, creating telemetry consumer%"), 0, 1)
| timechart latest(status) as status span=10m 
| rename status as "Connection Status (0=success, 1=failed/reconnecting)"

Chart is displaying "1" at 11:20 and "0" at 11:30, but for 11:40 also it's displaying "0" because it's considering no value as "0" as there is not log message at 11:40.

So, how can I get the last log message (latest message) when event doesn't exist at a given time frame and evaluate?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this untested query:

(index="05c48b55-c9aa-4743-aa4b-c0ec618691dd"  ( "Connecting ..." OR "Connected successfully, creating telemetry consumer ...")) 
| rex field=_raw "-\s(?<status_message>.*)" 
| eval status=if(like(status_message,"%Connected successfully, creating telemetry consumer%"), 0, 1)
| timechart latest(status) as status span=10m 
| filldown status
| rename status as "Connection Status (0=success, 1=failed/reconnecting)"
---
If this reply helps you, Karma would be appreciated.
0 Karma

pratapak
Explorer

@richgalloway thanks for the answer. But unfortunately it's not working.

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...