Splunk Search

How can I carry over field values into future time buckets?

DylanPCowan
New Member

I have three fields: order_number, status, and a timestamp for when that status became effective. There are three statuses - ready, in_progress, and complete. I need to create a dashboard that provides a monthly count for how many orders are in each status by month with a drill-down that will show the order numbers for a clicked status / month. I need help with the SPL to rearrange my data so that I can carry over the order_number and status into the following monthly time buckets. There are time gaps between status changes.

Example, time is bin span=1mon:
Order_Number - Status - _time
1 - ready - 201812
2 - ready - 201901
1 - in_progress - 201903
2 - in_progress - 201905
1 - complete - 201906
2 - complete - 201906

Looking for:
1- ready - 201812
1 - ready - 201901
2 - ready - 201901
1 - ready - 201902
2 - ready - 201902
1 - in_progress - 201903
2 - ready - 201903
1 - in_progress - 201904
2 - ready - 201904
1 - in_progress - 201905
2 - in_progress - 201905
1 - complete - 201906
2 - complete - 201906

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...