Splunk Search

Convert point in time events to timeseries with Data points

SplunkNs231
Engager

I have the following data. That I am trying to convert to a time series by Type with the last Status brought forward.

Raw data:

TimestampStatusType
10/28/2021 12:00downB
10/28/2021 12:10upA
10/28/2021 12:30upB
10/28/2021 13:10downB
10/28/2021 13:30upB

 

After transformation I need a data point every 10 minutes for each Type with the pervious Status brought forward. Note I could have 40-50 different types.

Example Transformation:

TimestampStatusType
10/28/2021 12:00downB
10/28/2021 12:10downB
10/28/2021 12:20downB
10/28/2021 12:30upB
10/28/2021 12:40upB
10/28/2021 12:50upB
10/28/2021 13:00upB
10/28/2021 13:10downB
10/28/2021 13:20downB
10/28/2021 13:30upB
10/28/2021 13:40upB

 

Any Ideas?

Labels (1)
Tags (1)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust
<your search>
| timechart span=10m last(status) by Type 
| filldown
| untable _time Type Status

Mind you that you might not get values at the beginning since you don't have any initial value.

Of course you might want to | sort at the end to your liking.

View solution in original post

0 Karma

PickleRick
SplunkTrust
SplunkTrust
<your search>
| timechart span=10m last(status) by Type 
| filldown
| untable _time Type Status

Mind you that you might not get values at the beginning since you don't have any initial value.

Of course you might want to | sort at the end to your liking.

0 Karma
Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...