Dashboards & Visualizations

how to check for alternate criteria for my description

chookp
Explorer

Hi my code is as follows:

DESCRIPTION="* sump *" OR (DESCRIPTION="* ejector pump *" AND DESCRIPTION="* run/stop *") (VALUE="RUN" OR VALUE="STOP" OR VALUE="TRIP") ASSET_NAME="*TAM/*" | eval TIMEONLY =strptime(CREATEDATETIME ,"%d/%m/%Y %I:%M:%S %p") | eval _time=TIMEONLY
| rex field=VALUE mode=sed "s/TRIP/STOP/g" | rex field=DESCRIPTION mode=sed "s/Trip/Run\/Stop/g" | rex field=ASSET_NAME "^(?<LOCATION>[^/]+)"
| streamstats count(eval(VALUE="STOP")) AS TransactionID BY ASSET_NAME DESCRIPTION
| stats range(_time) AS duration list(VALUE) AS VALUES min(_time) AS _time BY TransactionID ASSET_NAME DESCRIPTION
| eval newfield=if(duration>=1800,1,null)
| sort by ASSET_NAME

part of result i get:

problem 1.JPG

i would like to ask if there is a code which i can write so that under my description it can check that my Pumps are always working in alternating example 

STN DR Sump Pump 01 Run/Stop Status: DR Pump RM 01 

run and stop follow by 

STN DR Sump Pump 02 Run/Stop Status: DR Pump RM 01

then 

STN DR Sump Pump 01 Run/Stop Status: DR Pump RM 01

if there happen that the run/stop did not alternate it will have an alert or flag out abnormally or something

Labels (1)
0 Karma

chookp
Explorer

i am also finding a way to remove the result which my duration are 0 and values only stop

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...