Make a graph displaying enabled/disabled status of a process

[tbrown]

I have logs coming in that are the following: 

State change from '0' to '1' is complete

or

State change from '1' to '0' is complete

 on multiple nodes. 

Basically, I want a graph/visualization that displays the most recent status of the hosts. I've used | rex field to extract the value either '0/1' on each log after "to" but I'm wondering how I could do it so that the graph shows the most recent state of each node, maybe a bar graph or something where a green bar=1 and a red bar=0, separated by hosts.,

Any advice is appreciated, thanks!

[richgalloway · Accepted solution]

See if this helps.

index=foo
| rex "from \d to (?<state>\d)"
| stats latest(state) by host