Splunk Search

How to use the existence of a preceding event in timechart?

pm771
Communicator

I have an index where each event has unique EventID and Status fields.

Each event is progressing through multiple interim statuses until it reaches one of the two terminal statuses: SUCCESS or FAILURE.  Each event goes through a subset of all possible interim statuses.

I'm trying to build a timechart that would show two counts:  All Failed Events and Failed Events  with a certain Interim Status.

One of the problems is that a preceding interim event could be outside of the span interval.

I was thinking something along these lines (not necessarily syntactically correct): 

 

index=... sourcetype=... Status IN ("FAILURE", "INTERIM") 
| timechart span=5m count by  EventId  
| untable _time eventCount
| stats count as "All" count(eval(EventCount==2)) as "With Interim" by _time 

 

 

Labels (2)
0 Karma
1 Solution

to4kawa
Ultra Champion
index=... sourcetype=... Status IN ("FAILURE", "INTERIM") 
| stats min(eval(if(Status="INTERIM",_time,NULL))) as Interim min(eval(if(Status="FAILURE",_time,NULL))) as Failure by EventId
| eval Interim_EventID=if(isnotnull(Interim),EventID,NULL)
| eval time=mvappend(Interim,Failure)
| mvexpand time
| rename time as _time
| table _time EventId Interim_EventID
| sort _time


and
| timechart span=5m count(EventId) count(Interim_EventID)

View solution in original post

to4kawa
Ultra Champion
index=... sourcetype=... Status IN ("FAILURE", "INTERIM") 
| stats min(eval(if(Status="INTERIM",_time,NULL))) as Interim min(eval(if(Status="FAILURE",_time,NULL))) as Failure by EventId
| eval Interim_EventID=if(isnotnull(Interim),EventID,NULL)
| eval time=mvappend(Interim,Failure)
| mvexpand time
| rename time as _time
| table _time EventId Interim_EventID
| sort _time


and
| timechart span=5m count(EventId) count(Interim_EventID)

pm771
Communicator

@to4kawa ,

Thank you. It works.

Since I'm dealing with relatively large data sets I stumbled into 10,000 limit on sort.  

So, I used sort 0 _time.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...