Splunk Search

charting state as sequence of values in time

idsiano
Explorer

I have a log that contains a polling state of a device, PLUGGED/UNPLUGGED, logged every 10 s.
I want to chart a timeline in which each state is a point and y values are: PLUGGED=1,UNPLUGGED=0 so I can view the state of the device over the timespan.
How I get this?

Tags (1)
0 Karma
1 Solution

lguinn2
Legend

It is always nice to see an excerpt of the log, but I will hazard a guess

yoursearchhere
| eval status=if(match(_raw,"UNPLUGGED"),0,1)
| timechart span=10s avg(status)

You will not be able to show a very large timespan in a single chart, but this should work. It would be nicer if you had a field that contained the status, but that isn't necessary.

UPDATE: sorry, that was a dumb mistake on my part. I have updated the proposed solution to use avg(status) instead of just status. You could actually use almost any of the functions: first, last, avg - since there should only be one event in any 10 second period. But don't be surprised if you see two events (or zero events) in a time period; things are rarely perfect all the time...

View solution in original post

lguinn2
Legend

It is always nice to see an excerpt of the log, but I will hazard a guess

yoursearchhere
| eval status=if(match(_raw,"UNPLUGGED"),0,1)
| timechart span=10s avg(status)

You will not be able to show a very large timespan in a single chart, but this should work. It would be nicer if you had a field that contained the status, but that isn't necessary.

UPDATE: sorry, that was a dumb mistake on my part. I have updated the proposed solution to use avg(status) instead of just status. You could actually use almost any of the functions: first, last, avg - since there should only be one event in any 10 second period. But don't be surprised if you see two events (or zero events) in a time period; things are rarely perfect all the time...

idsiano
Explorer

I got the results with this :

index = hcd2 source="/algorithm/logs/debug.log" Plug_state 
| eval status=if(match(Plug_state,"EV_UNPLUGGED"),0,1) 
| timechart span=5s avg(status)

The problem is that timechart need an aggregation function, the only one that returns values similar to the discrete 0 and 1 is avg.

Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...