Can I graph data in text over time?

[bpfoster7]

I have data that is in text value that I want to graph over time.

index=pcrf sourcetype=rac* ha_state=* | table _time ha_state host

Where I want to visualize the text(ha_state) by host, it will be one of 3 values (King, Master, Slave). I didn't make up the values, the vendor did.

[DalJeanis]

Try this ...

index=pcrf sourcetype=rac* ha_state=* 
| fields _time ha_state host 
| Eval ShowState=case( ha_state="Slave", 1, ha_state="Master", 3 , ha_state="King", 7) 
| timechart avg(ShowState) as state by host 

At any given span of _time, the host on the top line will be King, the next Master, and any on the bottom will be Slave. If a host changes state during the span, then the reading will show somewhere in between.

We've adjusted the scale 1-3-7 so that any switches from top-bottom or bottom-top (Slave+King) are unlikely to land exactly on the middle (Master). If you prefer, you can adjust them to 1-3-4 or whatever.