Splunk Search

Creating a status graph - 0 or 1 - based only on "started" and "ended" messages

Jason
Motivator

I have a very similar question to this one:

I have a dataset that tells me when a service starts (such as index=_internal source=*splunkd.log "splunkd starting") and a similar one that tells me when a service stops (such as index=_internal source=*splunkd.log "all pipelines finished").

I want a graph of when the service is up (1) and when the service is down (0) from just these few events. The problem with timechart is that it will generate nulls for any time period that does not have one of these events - when it needs to be the the previous value - either still up or still down.

How do I chart this?

Also similar to this question as well.

Tags (2)
0 Karma
1 Solution

Ayn
Legend

Jason
Motivator

Great, thanks Ayn. Here is the search I ended up with, to show a weeklong timechart of whether Splunk was up or not for a particular hour (and show 0.5 if it was both up and down within the same hour): index=_internal source=*splunkd.log host=myhost ("splunkd starting" OR "all pipelines finished") | eval On=if(searchmatch("splunkd starting"), 1, 0) | timechart span=1h min(On) as Min max(On) as Max | eval SplunkOn=(Min+Max)/2 | filldown SplunkOn | fields _time SplunkOn

0 Karma

Ayn
Legend

Use filldown to replace null values with the last seen value:

http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Filldown

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...