Splunk Search

How to display two lines in a linechart based on one value?

Bleepie
Communicator

Dear Splunk Community,

Every 5 minutes the following event is generated :

2022-01-05 21:20:33 : Running

OR

2022-01-05 20:19:33 : Failed

I would like to display a timeline with two (2) lines showing when the system is running and when it fails. I have come so far:

 

running OR failed
| eval status = if(like(_raw, "%Running%"), "Running", "Not running")
| table status

 

 

I am in need of some guidance in this matter. How do I change the above search so that I have a line chart visualization with the two lines in it?

Thanks in advance.

 

 

Labels (4)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
running OR failed
| eval running= if(like(_raw, "%Running%"), 1, 0)
| eval notrunning= if(like(_raw, "%Running%"), 0, 1)
| table _time running notrunning

View solution in original post

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Are you thinking of timechart?

running OR failed
| rex "\s+:\s+(?<status>\w+)"
| timechart span=5m count by status

(rex is more standard way of extracting info with the type of  data you illustrated.)

0 Karma

Bleepie
Communicator

Thanks for your reply. I have however accepted the other answer as it gives me a visually more appealing result.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
running OR failed
| eval running= if(like(_raw, "%Running%"), 1, 0)
| eval notrunning= if(like(_raw, "%Running%"), 0, 1)
| table _time running notrunning
0 Karma
Get Updates on the Splunk Community!

.conf23 Registration is Now Open!

Time to toss the .conf-etti &#x1f389; —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...