Splunk Search

Creating a status graph - 0 or 1 - based only on "started" and "ended" messages

Jason
Motivator

I have a very similar question to this one:

I have a dataset that tells me when a service starts (such as index=_internal source=*splunkd.log "splunkd starting") and a similar one that tells me when a service stops (such as index=_internal source=*splunkd.log "all pipelines finished").

I want a graph of when the service is up (1) and when the service is down (0) from just these few events. The problem with timechart is that it will generate nulls for any time period that does not have one of these events - when it needs to be the the previous value - either still up or still down.

How do I chart this?

Also similar to this question as well.

Tags (2)
0 Karma
1 Solution

Ayn
Legend

Jason
Motivator

Great, thanks Ayn. Here is the search I ended up with, to show a weeklong timechart of whether Splunk was up or not for a particular hour (and show 0.5 if it was both up and down within the same hour): index=_internal source=*splunkd.log host=myhost ("splunkd starting" OR "all pipelines finished") | eval On=if(searchmatch("splunkd starting"), 1, 0) | timechart span=1h min(On) as Min max(On) as Max | eval SplunkOn=(Min+Max)/2 | filldown SplunkOn | fields _time SplunkOn

0 Karma

Ayn
Legend

Use filldown to replace null values with the last seen value:

http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Filldown

Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...