Splunk Search

How can I create a visual depiction of when a device is on or off over a period of time?

landster
Explorer

I have two separate events that logs a turn on and a turn off. I want to create a timechart showing when the device is on and off over a period of time. I only get a single event each time the state changes. How can I continue the state over time until a new state is recorded?

Tags (1)
0 Karma
1 Solution

niketn
Legend

@landster, you would need to provide you sample event and your current search for us to assist you better.

However, based on the description provided, if you have state field with value ON and OFF at certain time intervals, you can try the filldown command to use the value of state from the previous event in the same time series.

 <yourCurrentQuery>
| filldown state
| eval state_value=if(state=="ON",1,0)
| timechart span=1h sum(state_value) as value

Following is a run anywhere example with state as OFF at 0th hour (1st event) and ON at 9th Hour and finally OFF again at 19th Hour. PS: Commands from | gentimes till | eval state generate dummy data (run for Yesterday in the time picker):

| gentimes start=-1 end=0 increment=1h
| fields starttime
| eval _time=starttime
| fields _time
| eval date_hour=strftime(_time,"%H")
| eval state=case(date_hour=="00","OFF",date_hour=="09","ON",date_hour=="19","OFF")
| filldown state
| eval state_value=if(state=="ON",1,0)
| timechart span=1h sum(state_value) as value
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

kmorris_splunk
Splunk Employee
Splunk Employee

Using the search provided by @niketnilay, you could use a timeline visualization to represent this.

https://splunkbase.splunk.com/app/3120/

alt text

0 Karma

tjago11
Communicator

Is it possible to use the internal logs instead?? That way you can check for a phonehome event within your polling interval. If the event exists then the device is on, if not the device is off.

index=_* host=yourHostFilter phonehome
| timechart span=30m count by host 
| foreach * 
    [eval <<FIELD>>IsOn = if(<<FIELD>> > 0, 1, 0)
    | eval <<FIELD>>IsOff = if(<<FIELD>> = 0, 1, 0)
    ]
| fields + *IsOn + *IsOff

As long as you have a span that is >= your phone home interval this should work. Thanks.

0 Karma

niketn
Legend

@landster, you would need to provide you sample event and your current search for us to assist you better.

However, based on the description provided, if you have state field with value ON and OFF at certain time intervals, you can try the filldown command to use the value of state from the previous event in the same time series.

 <yourCurrentQuery>
| filldown state
| eval state_value=if(state=="ON",1,0)
| timechart span=1h sum(state_value) as value

Following is a run anywhere example with state as OFF at 0th hour (1st event) and ON at 9th Hour and finally OFF again at 19th Hour. PS: Commands from | gentimes till | eval state generate dummy data (run for Yesterday in the time picker):

| gentimes start=-1 end=0 increment=1h
| fields starttime
| eval _time=starttime
| fields _time
| eval date_hour=strftime(_time,"%H")
| eval state=case(date_hour=="00","OFF",date_hour=="09","ON",date_hour=="19","OFF")
| filldown state
| eval state_value=if(state=="ON",1,0)
| timechart span=1h sum(state_value) as value
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

landster
Explorer

Base Search:
index=ftgv2 sourcetype=FTGTVon* OR sourcetype=FTGTVoff*
| transaction terminalAddress startswith=(eventName=FTGTVOff) endswith=(eventName=FTGTVOn)

I am getting 2 events, one for TVOn and one for TVOff. They record the specific event and time by an identification number (terminalAddress). x axis would be time and y would be 1 for ON and 0 for OFF.

Does that make sense?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...