I have events that are statuses of cameras. I want to create a panel that outputs the names of the cameras whose status="Never_Checked" or "No_Images for three days in a row. For example, if camera 1A was never checked on 8/1, 8/2, and 8/3, 1A will be added to a list. Is this possible?
Let's make it flexible. If you select Last 3 days
then this will check for 3 days as you desire but if you change the timepicker, it will shift.
|gentimes start=-4
| rename starttime AS _time
| fields _time
| streamstats count AS _serial
| eval host="camera1 camera2 camera3 camera4 camera5"
| makemv host
| mvexpand host
| eval status=case(host="camera5", "OK",
host="camera1", "Never_Checked",
host="camera2", "No_Images",
_serial=1, "Never_Checked",
_serial=2, "No_Images",
_serial=3 AND host="camera3", "No_Images",
_serial=3 AND host="camera4", "OK",
true(), "No_Images")
| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"
| stats values(status) AS status dc(status) AS statusCount BY host
| where (statusCount=1 AND (status="Never_Checked" OR status="No_Images")) OR (statusCount=2 AND status="Never_Checked" AND status="No_Images")
try this
index=xx sourcetype=xxx earliest=-3d@d latest=now status="Never_Checked" OR status="No_Images" | table camera status
I hope status field got extracted from events.
It is not showing any events. This could be because I have only put in up to April 2017 this year into splunk. Is there a way I can make it looks at the 3 days before the date that is selected?
can you post one sample event