Splunk Search

Can I graph data in text over time?

bpfoster7
New Member

I have data that is in text value that I want to graph over time.

index=pcrf sourcetype=rac* ha_state=* | table _time ha_state host

Where I want to visualize the text(ha_state) by host, it will be one of 3 values (King, Master, Slave). I didn't make up the values, the vendor did.

0 Karma

DalJeanis
Legend

Try this ...

index=pcrf sourcetype=rac* ha_state=* 
| fields _time ha_state host 
| Eval ShowState=case( ha_state="Slave", 1, ha_state="Master", 3 , ha_state="King", 7) 
| timechart avg(ShowState) as state by host 

At any given span of _time, the host on the top line will be King, the next Master, and any on the bottom will be Slave. If a host changes state during the span, then the reading will show somewhere in between.

We've adjusted the scale 1-3-7 so that any switches from top-bottom or bottom-top (Slave+King) are unlikely to land exactly on the middle (Master). If you prefer, you can adjust them to 1-3-4 or whatever.

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...