Splunk Search

charting state as sequence of values in time

idsiano
Explorer

I have a log that contains a polling state of a device, PLUGGED/UNPLUGGED, logged every 10 s.
I want to chart a timeline in which each state is a point and y values are: PLUGGED=1,UNPLUGGED=0 so I can view the state of the device over the timespan.
How I get this?

Tags (1)
0 Karma
1 Solution

lguinn2
Legend

It is always nice to see an excerpt of the log, but I will hazard a guess

yoursearchhere
| eval status=if(match(_raw,"UNPLUGGED"),0,1)
| timechart span=10s avg(status)

You will not be able to show a very large timespan in a single chart, but this should work. It would be nicer if you had a field that contained the status, but that isn't necessary.

UPDATE: sorry, that was a dumb mistake on my part. I have updated the proposed solution to use avg(status) instead of just status. You could actually use almost any of the functions: first, last, avg - since there should only be one event in any 10 second period. But don't be surprised if you see two events (or zero events) in a time period; things are rarely perfect all the time...

View solution in original post

lguinn2
Legend

It is always nice to see an excerpt of the log, but I will hazard a guess

yoursearchhere
| eval status=if(match(_raw,"UNPLUGGED"),0,1)
| timechart span=10s avg(status)

You will not be able to show a very large timespan in a single chart, but this should work. It would be nicer if you had a field that contained the status, but that isn't necessary.

UPDATE: sorry, that was a dumb mistake on my part. I have updated the proposed solution to use avg(status) instead of just status. You could actually use almost any of the functions: first, last, avg - since there should only be one event in any 10 second period. But don't be surprised if you see two events (or zero events) in a time period; things are rarely perfect all the time...

idsiano
Explorer

I got the results with this :

index = hcd2 source="/algorithm/logs/debug.log" Plug_state 
| eval status=if(match(Plug_state,"EV_UNPLUGGED"),0,1) 
| timechart span=5s avg(status)

The problem is that timechart need an aggregation function, the only one that returns values similar to the discrete 0 and 1 is avg.

Get Updates on the Splunk Community!

From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...

It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...