I,
My use case :
We monitor change state events on projects :
{
date: 2018-02-06T11:00:07+01:00
id: 473184 <= event identifier
newStateId: 4
oldStateId: 2
projectId: 28381 <= project identifier
type: project_change_state
}
I need to know by day how many project are on the state "running" {2,3,4},
with the following request I'm able to extract the states change by day :
index="gtav21_logs" type=project_change_state projectId=12903
| sort id |eval _time=strptime('date',"%FT")
| stats last(id) as id,last(newStateId) as newStateId,first(newStateId) as oldStateId by _time
|table id,_time,newStateId
id _time newStateId
351577 2016-03-17 7
351578 2016-03-18 1
351579 2016-06-21 2
351575 2017-01-05 8
The problem is the gap between day, if I work on 1 project I can use makecontinuous & filldown but not scalable with
number of project >1.
My idea is to have something like :
projectId id _time newStateId
12903 351577 2016-03-17 7
12903 351578 2016-03-18 1
12903 >>351578 2016-03-19 1
12903 >>351578 2016-03-20 1
12903 >> ...
12903 351579 2016-06-21 2
12903 351575 2017-01-05 8
12904 ...
12904 ...
And then stats count by day,projectId ...
I hope to be clear enough ...
Thanks for your help !
