Getting Data In

How can I take multiple fields and time values and combine them into one?

hyungjoon
New Member

Suppose I have 4 fields

fields= "jobtype" values= A,B
fields= "status" values=1,2,3,4,5,6
fields= "Time1" values=.....................
fields= "Time2" values=.....................

I want to create a full day timestamp using the fields I have

(example)

Step 1 =    jobtype=A ,status=1 **earliest of Time1**       
Step 2 =    jobtype=A ,status=1 **latest of Time1**     
Step 3 =    jobtype=A, status=2 Or status=3 **earliest of Time2**       
Step 4 =    jobtype=A, status=2 Or status=4 **latest of Time2**     
Step 5 =    jobtype=B, status=5 **earliest of Time2**       
Step 6 =    jobtype=A, status=6 **earliest of Time2**   

Result would look something like this on one sheet

Step1---------- Step2------------ Step3--------- Step4------------ Step5---------- Step6

min(Time1) ---max( Time1)---min(Time2)-- max(Time2)----min(Time2)---min(Time2)

Because There is multiple fields and values involved, I cannot seem to get the right answer. Please help me

0 Karma

astein_splunk
Splunk Employee
Splunk Employee

Something like this? also it helps if you can share some mockup data or build it with makeresults . The only line below you should care about is xyseries I suspect. you may need a stats for this "max" requirement

| makeresults count=2
| streamstats count as count
| eval time=case(count=2,relative_time(now(),"+2d"),count=1,now())
| makecontinuous time span=15m
| eval _time=time
| eval job=if( random()%2==1,"JobA","JobB")
| streamstats count by job reset_on_change=true
| xyseries count, job, _time

Alternatively you may mean (you only care about the |Stats and |xyseries parts )

| makeresults count=2
| streamstats count as count
| eval time=case(count=2,relative_time(now(),"+2d"),count=1,now())
| makecontinuous time span=15m
| eval _time=time
| eval job=if( random()%2==1,"JobA","JobB")
| streamstats count by job reset_on_change=true
| stats max(_time) by count, job
| xyseries job, count, max(_time)

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...