How do I alter my search for multi (2) line chart that shows as one big line to show "Running" and "Stopped"?

[Bleepie]

Hello Splunk Community,

I have the following search command:

index="myIndex"
host="myHost" 
myScript
Running OR Stopped
| eval running= if(like(_raw, "%Running%"), 1, 0)
| eval stopped= if(like(_raw, "%Stopped%"), 0, 1)
| table _time running stopped
| rename running AS "UP"
| rename stopped AS "DOWN"

It looks strange like this:

There are four events with "Stopped" in it, the rest are all "Running". The script logs either Running or Stopped every 5 minutes. When I hover over the line it reports Down as 1 the entire time even though it should be 0 and only 1 four times. 

How do I adjust this so that it looks like this:

-------------_----------------

________--_________

Where the upper line = Running

And the bottom line = Stopped

[JacekF]

Will this meet your requirements?

| makeresults
| eval data = "0,1|1,0|1,0|0,1|1,0|0,1|1,0|1,0|0,1|1,0"
| makemv data delim="|"
| mvexpand data
| makemv data delim=","
| eval UP=mvindex(data,1)
| eval DOWN=mvindex(data, 0)
| fields - data
| streamstats count
| eval _time = relative_time(_time, "+".(count*5)."m")
| fields - count
| timechart latest(DOWN) as DOWN latest(UP) as UP span=5m

Please note that everything up to the timechart command is just to generate some data, you don't need it in your search.

[Bleepie]

Hi! Thanks for your response,

So it is supposed to be like this? :

index="myIndex"
host="myHost" 
myScript
Running OR Stopped
| timechart latest(DOWN) as DOWN latest(UP) as UP span=5m

If I use this, the events are found but the data UP/DOWN are both never occuring resulting in this:

[JacekF · Accepted solution]

You've missed two lines from your original query. The entire query should look like this:

index="myIndex"
host="myHost" 
myScript
Running OR Stopped
| eval running= if(like(_raw, "%Running%"), 1, 0)
| eval stopped= if(like(_raw, "%Stopped%"), 0, 1)
| timechart latest(running) as UP latest(stopped) as DOWN span=5m

[Bleepie]

Thank you it works!