Dear Splunk Community,
Every 5 minutes the following event is generated :
2022-01-05 21:20:33 : Running
OR
2022-01-05 20:19:33 : Failed
I would like to display a timeline with two (2) lines showing when the system is running and when it fails. I have come so far:
running OR failed
| eval status = if(like(_raw, "%Running%"), "Running", "Not running")
| table status
I am in need of some guidance in this matter. How do I change the above search so that I have a line chart visualization with the two lines in it?
Thanks in advance.
running OR failed
| eval running= if(like(_raw, "%Running%"), 1, 0)
| eval notrunning= if(like(_raw, "%Running%"), 0, 1)
| table _time running notrunning
Are you thinking of timechart?
running OR failed
| rex "\s+:\s+(?<status>\w+)"
| timechart span=5m count by status
(rex is more standard way of extracting info with the type of data you illustrated.)
Thanks for your reply. I have however accepted the other answer as it gives me a visually more appealing result.
running OR failed
| eval running= if(like(_raw, "%Running%"), 1, 0)
| eval notrunning= if(like(_raw, "%Running%"), 0, 1)
| table _time running notrunning