Splunk Search
Highlighted

How to filldown by multiple criteria ?

Explorer

I,

My use case :

We monitor change state events on projects :

{

date: 2018-02-06T11:00:07+01:00

id: 473184 <= event identifier
newStateId: 4

oldStateId: 2

projectId: 28381 <= project identifier
type: projectchangestate

}

I need to know by day how many project are on the state "running" {2,3,4},
with the following request I'm able to extract the states change by day :

index="gtav21logs" type=projectchangestate projectId=12903
| sort id |eval _time=strptime('date',"%FT")
| stats last(id) as id,last(newStateId) as newStateId,first(newStateId) as oldStateId by _time
|table id,
time,newStateId

id _time newStateId
351577 2016-03-17 7
351578 2016-03-18 1
351579 2016-06-21 2
351575 2017-01-05 8

The problem is the gap between day, if I work on 1 project I can use makecontinuous & filldown but not scalable with
number of project >1.

My idea is to have something like :

projectId id _time newStateId
12903 351577 2016-03-17 7
12903 351578 2016-03-18 1
12903 >>351578 2016-03-19 1
12903 >>351578 2016-03-20 1
12903 >> ...
12903 351579 2016-06-21 2
12903 351575 2017-01-05 8
12904 ...
12904 ...

And then stats count by day,projectId ...

I hope to be clear enough ...

Thanks for your help !

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.