Dashboards & Visualizations

Graph path

Timeago
Explorer

Hello!

I need to make graph path for the field "Status".

1st step:




































time Name Status
... Name1 A
... Name2 B
... Name1 C
... Name1 A
... Name2 A

2nd step:

...|sort 0 Name time

time Name Status
... Name1 A
... Name1 C
... Name1 A
... Name2 B
... Name2 A

3rd step:

time Name Status Previous_Status
... Name1 A C
... Name1 C A
... Name1 A
... Name2 B A
... Name2 A

So, how can i make the 3rd step?
Or suggest another way to solve this problem?

Thank you

Tags (2)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi Timeago

you should be able to get this by using streamstats

The streamstats command, similar to the stats command, calculates summary statistics on search results. Unlike, stats (which works on the results as a whole), streamstats calculates statistics for each event at the time the event is seen.

Combined with eval you can make new fields and compare them to each other.

Hope this helps to get you started...........

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi Timeago

you should be able to get this by using streamstats

The streamstats command, similar to the stats command, calculates summary statistics on search results. Unlike, stats (which works on the results as a whole), streamstats calculates statistics for each event at the time the event is seen.

Combined with eval you can make new fields and compare them to each other.

Hope this helps to get you started...........

cheers, MuS

View solution in original post

kristian_kolb
Ultra Champion

Hmmm.. maybe. try this as a start.. not tested..

... | sort +Name, +_time | streamstats window=1 current=false first(Status) as Previous_Status

/K

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!