I have the following data. That I am trying to convert to a time series by Type with the last Status brought forward.
Raw data:
Timestamp | Status | Type |
10/28/2021 12:00 | down | B |
10/28/2021 12:10 | up | A |
10/28/2021 12:30 | up | B |
10/28/2021 13:10 | down | B |
10/28/2021 13:30 | up | B |
After transformation I need a data point every 10 minutes for each Type with the pervious Status brought forward. Note I could have 40-50 different types.
Example Transformation:
Timestamp | Status | Type |
10/28/2021 12:00 | down | B |
10/28/2021 12:10 | down | B |
10/28/2021 12:20 | down | B |
10/28/2021 12:30 | up | B |
10/28/2021 12:40 | up | B |
10/28/2021 12:50 | up | B |
10/28/2021 13:00 | up | B |
10/28/2021 13:10 | down | B |
10/28/2021 13:20 | down | B |
10/28/2021 13:30 | up | B |
10/28/2021 13:40 | up | B |
Any Ideas?
<your search>
| timechart span=10m last(status) by Type
| filldown
| untable _time Type Status
Mind you that you might not get values at the beginning since you don't have any initial value.
Of course you might want to | sort at the end to your liking.
<your search>
| timechart span=10m last(status) by Type
| filldown
| untable _time Type Status
Mind you that you might not get values at the beginning since you don't have any initial value.
Of course you might want to | sort at the end to your liking.