Splunk Search

How can I create a visual depiction of when a device is on or off over a period of time?

landster
Explorer

I have two separate events that logs a turn on and a turn off. I want to create a timechart showing when the device is on and off over a period of time. I only get a single event each time the state changes. How can I continue the state over time until a new state is recorded?

Tags (1)
0 Karma
1 Solution

@landster, you would need to provide you sample event and your current search for us to assist you better.

However, based on the description provided, if you have state field with value ON and OFF at certain time intervals, you can try the filldown command to use the value of state from the previous event in the same time series.

 <yourCurrentQuery>
| filldown state
| eval state_value=if(state=="ON",1,0)
| timechart span=1h sum(state_value) as value

Following is a run anywhere example with state as OFF at 0th hour (1st event) and ON at 9th Hour and finally OFF again at 19th Hour. PS: Commands from | gentimes till | eval state generate dummy data (run for Yesterday in the time picker):

| gentimes start=-1 end=0 increment=1h
| fields starttime
| eval _time=starttime
| fields _time
| eval date_hour=strftime(_time,"%H")
| eval state=case(date_hour=="00","OFF",date_hour=="09","ON",date_hour=="19","OFF")
| filldown state
| eval state_value=if(state=="ON",1,0)
| timechart span=1h sum(state_value) as value
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

kmorris_splunk
Splunk Employee
Splunk Employee

Using the search provided by @niketnilay, you could use a timeline visualization to represent this.

https://splunkbase.splunk.com/app/3120/

alt text

0 Karma

tjago11
Communicator

Is it possible to use the internal logs instead?? That way you can check for a phonehome event within your polling interval. If the event exists then the device is on, if not the device is off.

index=_* host=yourHostFilter phonehome
| timechart span=30m count by host 
| foreach * 
    [eval <<FIELD>>IsOn = if(<<FIELD>> > 0, 1, 0)
    | eval <<FIELD>>IsOff = if(<<FIELD>> = 0, 1, 0)
    ]
| fields + *IsOn + *IsOff

As long as you have a span that is >= your phone home interval this should work. Thanks.

0 Karma

@landster, you would need to provide you sample event and your current search for us to assist you better.

However, based on the description provided, if you have state field with value ON and OFF at certain time intervals, you can try the filldown command to use the value of state from the previous event in the same time series.

 <yourCurrentQuery>
| filldown state
| eval state_value=if(state=="ON",1,0)
| timechart span=1h sum(state_value) as value

Following is a run anywhere example with state as OFF at 0th hour (1st event) and ON at 9th Hour and finally OFF again at 19th Hour. PS: Commands from | gentimes till | eval state generate dummy data (run for Yesterday in the time picker):

| gentimes start=-1 end=0 increment=1h
| fields starttime
| eval _time=starttime
| fields _time
| eval date_hour=strftime(_time,"%H")
| eval state=case(date_hour=="00","OFF",date_hour=="09","ON",date_hour=="19","OFF")
| filldown state
| eval state_value=if(state=="ON",1,0)
| timechart span=1h sum(state_value) as value
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

landster
Explorer

Base Search:
index=ftgv2 sourcetype=FTGTVon* OR sourcetype=FTGTVoff*
| transaction terminalAddress startswith=(eventName=FTGTVOff) endswith=(eventName=FTGTVOn)

I am getting 2 events, one for TVOn and one for TVOff. They record the specific event and time by an identification number (terminalAddress). x axis would be time and y would be 1 for ON and 0 for OFF.

Does that make sense?

0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...