Getting Data In
Highlighted

How can I take multiple fields and time values and combine them into one?

New Member

Suppose I have 4 fields

fields= "jobtype" values= A,B
fields= "status" values=1,2,3,4,5,6
fields= "Time1" values=.....................
fields= "Time2" values=.....................

I want to create a full day timestamp using the fields I have

(example)

Step 1 =    jobtype=A ,status=1 **earliest of Time1**       
Step 2 =    jobtype=A ,status=1 **latest of Time1**     
Step 3 =    jobtype=A, status=2 Or status=3 **earliest of Time2**       
Step 4 =    jobtype=A, status=2 Or status=4 **latest of Time2**     
Step 5 =    jobtype=B, status=5 **earliest of Time2**       
Step 6 =    jobtype=A, status=6 **earliest of Time2**   

Result would look something like this on one sheet

Step1---------- Step2------------ Step3--------- Step4------------ Step5---------- Step6

min(Time1) ---max( Time1)---min(Time2)-- max(Time2)----min(Time2)---min(Time2)

Because There is multiple fields and values involved, I cannot seem to get the right answer. Please help me

0 Karma
Highlighted

Re: How can I take multiple fields and time values and combine them into one?

Splunk Employee
Splunk Employee

Something like this? also it helps if you can share some mockup data or build it with makeresults . The only line below you should care about is xyseries I suspect. you may need a stats for this "max" requirement

| makeresults count=2
| streamstats count as count
| eval time=case(count=2,relativetime(now(),"+2d"),count=1,now())
| makecontinuous time span=15m
| eval _time=time
| eval job=if( random()%2==1,"JobA","JobB")
| streamstats count by job reset
on_change=true
| xyseries count, job, _time

Alternatively you may mean (you only care about the |Stats and |xyseries parts )

| makeresults count=2
| streamstats count as count
| eval time=case(count=2,relativetime(now(),"+2d"),count=1,now())
| makecontinuous time span=15m
| eval _time=time
| eval job=if( random()%2==1,"JobA","JobB")
| streamstats count by job reset
onchange=true
| stats max(
time) by count, job
| xyseries job, count, max(_time)

0 Karma