Hi,
basically you might want to use timechart to get a time series with span=1d in order to aggregate to one day. You could aggregate all your values with avg(xxx) as xxx or any other aggregation method (also list() might help with developing that spl).
Plain and expensive would be using join :
index=X "Name"="X" sourcetype=csv EXEC_AVAILABILITY=201 OR 401
| eval value = tonumber(replace(STEP_RESPONSE_TIME, "," , ""),10)/1000
| eval name = strftime(_time,"%d/%m/%y")
| eval order = strftime(_time,"%w")
| eval status=case(value<=4.0,"GREEN",value>=4.0 AND value <=6.5, "AMBER", 1==1, "RED")
| eval new_time = strptime("2018-01-01 " . strftime(_time, "%H:%M"), "%Y-%m-%d %H:%M")
| rename new_time as _time
| eval status = value
| sort name, _time
| table _time, name, value, status, order
| join type=inner _time [
| gentimes start=11/1/2018 increment=1d
| eval _time=starttime
| eval name = strftime(_time,"%d/%m/%y") | eval order = strftime(_time,"%w")
| eval value=" "
| table _time, name, value, status
]
Cheerz,
Björn
... View more