How to create a timechart to show only when values change for a particular field?

[vrmandadi]

Hello Splunkers ,

I want to know if we can create a timechart that will show only values when they change ..If  there is a change in field value

Below is the timechart of events every minute

2022-12-12 20:41:00	IDLE
2022-12-12 20:40:00	ACTIVE
2022-12-12 20:39:00	FALSE
2022-12-12 20:38:00	FALSE
2022-12-12 20:37:00	FALSE
2022-12-12 20:36:00	TRUE
2022-12-12 20:35:00	TRUE
2022-12-12 20:34:00	TRUE
2022-12-12 20:33:00	TRUE
2022-12-12 20:31:00	NEGATIVE
2022-12-12 20:30:00	NEGATIVE
2022-12-12 20:29:00	NEGATIVE
2022-12-12 20:28:00	TRUE

I am looking for

2022-12-12 20:41:00	IDLE
2022-12-12 20:40:00	ACTIVE
2022-12-12 20:39:00	FALSE
2022-12-12 20:36:00	TRUE
2022-12-12 20:31:00	NEGATIVE
2022-12-12 20:28:00	TRUE

Thanks in advance!!

[bowesmana · Accepted solution]

Use streamstats to find the first instance of each type - here's an example using your data - the last two lines are relevant to your use case - I've assumed your field name is called 'Status'

| makeresults
| eval _raw="2022-12-12 20:41:00	IDLE
2022-12-12 20:40:00	ACTIVE
2022-12-12 20:39:00	FALSE
2022-12-12 20:38:00	FALSE
2022-12-12 20:37:00	FALSE
2022-12-12 20:36:00	TRUE
2022-12-12 20:35:00	TRUE
2022-12-12 20:34:00	TRUE
2022-12-12 20:33:00	TRUE
2022-12-12 20:31:00	NEGATIVE
2022-12-12 20:30:00	NEGATIVE
2022-12-12 20:29:00	NEGATIVE
2022-12-12 20:28:00	TRUE"
| multikv noheader=t
| eval _time=strptime(Column_1, "%F %T")
| rename Column_2 as Status
| table _time Status
``` Do this ```
| streamstats count by Status reset_on_change=t
| where count=1

[vrmandadi]

Thank you