Splunk Search

charting state as sequence of values in time

idsiano
Explorer

I have a log that contains a polling state of a device, PLUGGED/UNPLUGGED, logged every 10 s.
I want to chart a timeline in which each state is a point and y values are: PLUGGED=1,UNPLUGGED=0 so I can view the state of the device over the timespan.
How I get this?

Tags (1)
0 Karma
1 Solution

lguinn2
Legend

It is always nice to see an excerpt of the log, but I will hazard a guess

yoursearchhere
| eval status=if(match(_raw,"UNPLUGGED"),0,1)
| timechart span=10s avg(status)

You will not be able to show a very large timespan in a single chart, but this should work. It would be nicer if you had a field that contained the status, but that isn't necessary.

UPDATE: sorry, that was a dumb mistake on my part. I have updated the proposed solution to use avg(status) instead of just status. You could actually use almost any of the functions: first, last, avg - since there should only be one event in any 10 second period. But don't be surprised if you see two events (or zero events) in a time period; things are rarely perfect all the time...

View solution in original post

lguinn2
Legend

It is always nice to see an excerpt of the log, but I will hazard a guess

yoursearchhere
| eval status=if(match(_raw,"UNPLUGGED"),0,1)
| timechart span=10s avg(status)

You will not be able to show a very large timespan in a single chart, but this should work. It would be nicer if you had a field that contained the status, but that isn't necessary.

UPDATE: sorry, that was a dumb mistake on my part. I have updated the proposed solution to use avg(status) instead of just status. You could actually use almost any of the functions: first, last, avg - since there should only be one event in any 10 second period. But don't be surprised if you see two events (or zero events) in a time period; things are rarely perfect all the time...

idsiano
Explorer

I got the results with this :

index = hcd2 source="/algorithm/logs/debug.log" Plug_state 
| eval status=if(match(Plug_state,"EV_UNPLUGGED"),0,1) 
| timechart span=5s avg(status)

The problem is that timechart need an aggregation function, the only one that returns values similar to the discrete 0 and 1 is avg.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...