Getting Data In

How can I take multiple fields and time values and combine them into one?

hyungjoon
New Member

Suppose I have 4 fields

fields= "jobtype" values= A,B
fields= "status" values=1,2,3,4,5,6
fields= "Time1" values=.....................
fields= "Time2" values=.....................

I want to create a full day timestamp using the fields I have

(example)

Step 1 =    jobtype=A ,status=1 **earliest of Time1**       
Step 2 =    jobtype=A ,status=1 **latest of Time1**     
Step 3 =    jobtype=A, status=2 Or status=3 **earliest of Time2**       
Step 4 =    jobtype=A, status=2 Or status=4 **latest of Time2**     
Step 5 =    jobtype=B, status=5 **earliest of Time2**       
Step 6 =    jobtype=A, status=6 **earliest of Time2**   

Result would look something like this on one sheet

Step1---------- Step2------------ Step3--------- Step4------------ Step5---------- Step6

min(Time1) ---max( Time1)---min(Time2)-- max(Time2)----min(Time2)---min(Time2)

Because There is multiple fields and values involved, I cannot seem to get the right answer. Please help me

0 Karma

astein_splunk
Splunk Employee
Splunk Employee

Something like this? also it helps if you can share some mockup data or build it with makeresults . The only line below you should care about is xyseries I suspect. you may need a stats for this "max" requirement

| makeresults count=2
| streamstats count as count
| eval time=case(count=2,relative_time(now(),"+2d"),count=1,now())
| makecontinuous time span=15m
| eval _time=time
| eval job=if( random()%2==1,"JobA","JobB")
| streamstats count by job reset_on_change=true
| xyseries count, job, _time

Alternatively you may mean (you only care about the |Stats and |xyseries parts )

| makeresults count=2
| streamstats count as count
| eval time=case(count=2,relative_time(now(),"+2d"),count=1,now())
| makecontinuous time span=15m
| eval _time=time
| eval job=if( random()%2==1,"JobA","JobB")
| streamstats count by job reset_on_change=true
| stats max(_time) by count, job
| xyseries job, count, max(_time)

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...