I have a log that contains a polling state of a device, PLUGGED/UNPLUGGED, logged every 10 s.
I want to chart a timeline in which each state is a point and y values are: PLUGGED=1,UNPLUGGED=0 so I can view the state of the device over the timespan.
How I get this?
It is always nice to see an excerpt of the log, but I will hazard a guess
yoursearchhere
| eval status=if(match(_raw,"UNPLUGGED"),0,1)
| timechart span=10s avg(status)
You will not be able to show a very large timespan in a single chart, but this should work. It would be nicer if you had a field that contained the status, but that isn't necessary.
UPDATE: sorry, that was a dumb mistake on my part. I have updated the proposed solution to use avg(status)
instead of just status
. You could actually use almost any of the functions: first, last, avg - since there should only be one event in any 10 second period. But don't be surprised if you see two events (or zero events) in a time period; things are rarely perfect all the time...
It is always nice to see an excerpt of the log, but I will hazard a guess
yoursearchhere
| eval status=if(match(_raw,"UNPLUGGED"),0,1)
| timechart span=10s avg(status)
You will not be able to show a very large timespan in a single chart, but this should work. It would be nicer if you had a field that contained the status, but that isn't necessary.
UPDATE: sorry, that was a dumb mistake on my part. I have updated the proposed solution to use avg(status)
instead of just status
. You could actually use almost any of the functions: first, last, avg - since there should only be one event in any 10 second period. But don't be surprised if you see two events (or zero events) in a time period; things are rarely perfect all the time...
I got the results with this :
index = hcd2 source="/algorithm/logs/debug.log" Plug_state
| eval status=if(match(Plug_state,"EV_UNPLUGGED"),0,1)
| timechart span=5s avg(status)
The problem is that timechart need an aggregation function, the only one that returns values similar to the discrete 0 and 1 is avg.