How could I create a timespan for alternating events?

[Felix82]

Hey Splunk- community, 

I need your help again. My data are events which reports disturbments. "action=kommend" marks the start of disturbment, "action=gehend" the end of disturbment (action=0 => disturbment; action=1 => no disturbment). 

I have to consider one important condition: the reason of both events schould be same (Störung=X (action=kommend) => Störung=X (action=gehend)). Alternatively there is the possibility to use "transaction" but there excists same problem:

How could I command the search to produce time- connected events which hold the status? The actual result looks like first picture following but it should looks like second to compare them in one line chart (compare human reported disturbments with machine reported disturbments).

Thank you very much and kind regards from Germany,
Felix

Actual result

How it should looks like

[ITWhisperer]

Try something like this

| makecontinuous span=1m _time
| filldown list(action)

[Felix82]

Hi @ITWhisperer,

thank you for your anwser! I've tested different syntaxes, different comands, research comands at "Splunk Search Reference" and changed fields... The search now creates the desired time- list but doesn't fill the gaps.

Spoiler

index=machinedata_w05_sum app=StörungenPulveranlagen "Linie 1"
| replace "gehend" WITH "1" IN "action"
| replace "kommend" WITH "0" in "action"
| makecontinuous span=10s _time
| filldown action

Spoiler

index=machinedata_w05_sum app=StörungenPulveranlagen "Linie 1"
| replace "gehend" WITH "1" IN "action"
| replace "kommend" WITH "0" in "action"
| makecontinuous span=10s _time
| filldown action
| chart list(action) OVER _time

Spoiler

index=machinedata_w05_sum app=StörungenPulveranlagen "Linie 1"
| replace "gehend" WITH "1" IN "action"
| replace "kommend" WITH "0" in "action"
| chart list(action) OVER _time
| makecontinuous span=10s _time
| filldown action

Spoiler

index=machinedata_w05_sum app=StörungenPulveranlagen "Linie 1"
| replace "gehend" WITH "1" IN "action"
| replace "kommend" WITH "0" in "action"
| chart list(action) OVER _time
| makecontinuous span=10s action

Spoiler

index=machinedata_w05_sum app=StörungenPulveranlagen "Linie 1"
| replace "gehend" WITH "1" IN "action"
| replace "kommend" WITH "0" in "action"
| chart list(action) OVER _time
| makecontinuous span=10s _time

Spoiler

index=machinedata_w05_sum app=StörungenPulveranlagen "Linie 1"
| replace "gehend" WITH "1" IN "action"
| replace "kommend" WITH "0" in "action"
| timechart list(action)
| makecontinuous span=10s _time

Spoiler

index=machinedata_w05_sum app=StörungenPulveranlagen "Linie 1"
| replace "gehend" WITH "1" IN "action"
| replace "kommend" WITH "0" in "action"
| timechart list(action)
| makecontinuous span=10s _time
| filldown action

The results always looks like following or similar:

Kind regards,

Felix

[ITWhisperer · Accepted solution]

So you didn't try what I suggested (the field with the list in is not called action unless you rename it) - try it this way

index=machinedata_w05_sum app=StörungenPulveranlagen "Linie 1"
| replace "gehend" WITH "1" IN "action"
| replace "kommend" WITH "0" in "action"
| timechart list(action) as action
| makecontinuous span=10s _time
| filldown action

[Felix82]

Ops - excuse me, please, I just work with splunk since effectively two weeks. Actual it's more experimenting than knowledge.

Your last suggestion works nearly great - it only left a few gaps in visualization. I hope I could solve the last problems and fill the gaps myself now.

Thank you very much!

Felix