Dashboard outputting pattern

[sarahw3]

I have events that are statuses of cameras. I want to create a panel that outputs the names of the cameras whose status="Never_Checked" or "No_Images for three days in a row. For example, if camera 1A was never checked on 8/1, 8/2, and 8/3, 1A will be added to a list. Is this possible?

[woodcock]

Let's make it flexible. If you select Last 3 days then this will check for 3 days as you desire but if you change the timepicker, it will shift.

|gentimes start=-4
| rename starttime AS _time
| fields _time
| streamstats count AS _serial
| eval host="camera1 camera2 camera3 camera4 camera5"
| makemv host
| mvexpand host
| eval status=case(host="camera5", "OK",
                   host="camera1", "Never_Checked",
                   host="camera2", "No_Images",
                   _serial=1, "Never_Checked",
                   _serial=2, "No_Images",
                   _serial=3 AND host="camera3", "No_Images",
                   _serial=3 AND host="camera4", "OK",
                   true(), "No_Images")

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| stats values(status) AS status dc(status) AS statusCount BY host
| where (statusCount=1 AND (status="Never_Checked" OR status="No_Images")) OR (statusCount=2 AND status="Never_Checked" AND status="No_Images")

[sbbadri]

try this

index=xx sourcetype=xxx earliest=-3d@d latest=now status="Never_Checked" OR status="No_Images" | table camera status

I hope status field got extracted from events.

[sarahw3]

It is not showing any events. This could be because I have only put in up to April 2017 this year into splunk. Is there a way I can make it looks at the 3 days before the date that is selected?

[sbbadri]

can you post one sample event