charting state as sequence of values in time

[idsiano]

I have a log that contains a polling state of a device, PLUGGED/UNPLUGGED, logged every 10 s.
I want to chart a timeline in which each state is a point and y values are: PLUGGED=1,UNPLUGGED=0 so I can view the state of the device over the timespan.
How I get this?

[lguinn2 · Accepted solution]

It is always nice to see an excerpt of the log, but I will hazard a guess

yoursearchhere
| eval status=if(match(_raw,"UNPLUGGED"),0,1)
| timechart span=10s avg(status)

You will not be able to show a very large timespan in a single chart, but this should work. It would be nicer if you had a field that contained the status, but that isn't necessary.

UPDATE: sorry, that was a dumb mistake on my part. I have updated the proposed solution to use avg(status) instead of just status. You could actually use almost any of the functions: first, last, avg - since there should only be one event in any 10 second period. But don't be surprised if you see two events (or zero events) in a time period; things are rarely perfect all the time...

[idsiano]

I got the results with this :

index = hcd2 source="/algorithm/logs/debug.log" Plug_state 
| eval status=if(match(Plug_state,"EV_UNPLUGGED"),0,1) 
| timechart span=5s avg(status)

The problem is that timechart need an aggregation function, the only one that returns values similar to the discrete 0 and 1 is avg.