Creating a status graph - 0 or 1 - based only on "started" and "ended" messages

[Jason]

I have a very similar question to this one:

I have a dataset that tells me when a service starts (such as index=_internal source=*splunkd.log "splunkd starting") and a similar one that tells me when a service stops (such as index=_internal source=*splunkd.log "all pipelines finished").

I want a graph of when the service is up (1) and when the service is down (0) from just these few events. The problem with timechart is that it will generate nulls for any time period that does not have one of these events - when it needs to be the the previous value - either still up or still down.

How do I chart this?

Also similar to this question as well.

[Jason]

Great, thanks Ayn. Here is the search I ended up with, to show a weeklong timechart of whether Splunk was up or not for a particular hour (and show 0.5 if it was both up and down within the same hour): index=_internal source=*splunkd.log host=myhost ("splunkd starting" OR "all pipelines finished") | eval On=if(searchmatch("splunkd starting"), 1, 0) | timechart span=1h min(On) as Min max(On) as Max | eval SplunkOn=(Min+Max)/2 | filldown SplunkOn | fields _time SplunkOn

[Ayn · Accepted solution]

Use filldown to replace null values with the last seen value:

http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Filldown