Report a value from a field to another result line

[Rajaion]

Hello community,

I need to set up a dashboard that tracks the status of an alert from Splunk OnCall. An alert can have 2 to 3 statuses and I would like to retrieve the _time of each step and keep it in memory for each state (to make duration calculations in particular) :

I manage to retrieve the _time for each state in a dedicated field but I cannot transfer this value to the other states:

index=oncall_prod originOnCall="Prod" incidentNumber=497764
| sort _time desc
| rex field=entityDisplayName "(?<Priorité>..) - (?<Titre>.*)"

| eval startAlert = if(alertType == "CRITICAL", _time, "")
| eval startAlert = strftime(startAlert,"%Y-%m-%d %H:%M:%S ")

| eval ackAlert = if(alertType == "ACKNOWLEDGEMENT", _time, "")
| eval ackAlert = strftime(ackAlert,"%Y-%m-%d %H:%M:%S ")

| eval endAlert = if(alertType == "RECOVERY", _time, "")
| eval endAlert = strftime(endAlert,"%Y-%m-%d %H:%M:%S ")

| table _time, incidentNumber, alertType, Priorité, Titre, startAlert, ackAlert, endAlert, ticket_EV

Do you have any idea how to do this? I searched the forum but couldn't find a solution that matched my problem.

Sincerely,

Rajaion

[ITWhisperer]

index=oncall_prod originOnCall="Prod" incidentNumber=497764
| sort _time desc
| rex field=entityDisplayName "(?<Priorité>..) - (?<Titre>.*)"

| eval startAlert = if(alertType == "CRITICAL", _time, "")
| eval startAlert = strftime(startAlert,"%Y-%m-%d %H:%M:%S ")

| eval ackAlert = if(alertType == "ACKNOWLEDGEMENT", _time, "")
| eval ackAlert = strftime(ackAlert,"%Y-%m-%d %H:%M:%S ")

| eval endAlert = if(alertType == "RECOVERY", _time, "")
| eval endAlert = strftime(endAlert,"%Y-%m-%d %H:%M:%S ")

| stats values(alertType) as alertType, values(Priorité) as Priorité, values(Titre) as Titre, values(startAlert) as startAlert, values(ackAlert) as ackAlert, values(endAlert) as endAlert, values(ticket_EV) as ticket_EV by incidentNumber

[Rajaion]

Hello @ITWhisperer,

Thank you for your help, I tried to add your line but it aggregates all the lines between them and if in absolute terms, I see everything on a single line, I cannot manipulate the data (for example, put a message when there has been no acknowledgment):

Example :
| eval ticket_EV = if(alertType == "RECOVERY" AND (isnull(ackAlert)), "No ticket", ticket_EV)

Sincerely,

Rajaion

[ITWhisperer · Accepted solution]

index=oncall_prod originOnCall="Prod" incidentNumber=497764
| sort _time desc
| rex field=entityDisplayName "(?<Priorité>..) - (?<Titre>.*)"

| eval startAlert = if(alertType == "CRITICAL", _time, "")
| eval startAlert = strftime(startAlert,"%Y-%m-%d %H:%M:%S ")

| eval ackAlert = if(alertType == "ACKNOWLEDGEMENT", _time, "")
| eval ackAlert = strftime(ackAlert,"%Y-%m-%d %H:%M:%S ")

| eval endAlert = if(alertType == "RECOVERY", _time, "")
| eval endAlert = strftime(endAlert,"%Y-%m-%d %H:%M:%S ")

| eventstats values(startAlert) as startAlert, values(ackAlert) as ackAlert, values(endAlert) as endAlert, values(ticket_EV) as ticket_EV by incidentNumber

[Rajaion]

This is exactly what I was looking for, I can do my difference operations this way. Thank you for your help.

Sincerely,

Rajaion