Hello,
I try to use the latest()
option of eventstats in the following way:
| eventstats latest(Status) AS Status_last by Application |sort 0 _time| dedup _raw| table _time Status Status_last
In fact, I used a regex to define "Status" in a log line and I want to display the Current Status (current log line) and the status value of the previous logs line.
As below the problem is the Status_last raised is not good.
_time Status Status_last
2015-03-31 19:28:05 DEGRADED OPERATIONAL
2015-03-31 19:29:05 OPERATIONAL OPERATIONAL <= instead of Degraded
Please help ! !!
OK, like this:
... | dedup _raw | reverse | streamstats current=f last(Status) AS PrevStatus BY Application | reverse | dedup Application | table _time Applicatoin Status PrevStatus
OK, like this:
... | dedup _raw | reverse | streamstats current=f last(Status) AS PrevStatus BY Application | reverse | dedup Application | table _time Applicatoin Status PrevStatus
Perfect ! That's work ! Thanks a lot
latest(Status)
finds the most recent value of Status
, not the previous value.
Therefore how could I find the previous value ?