I have data that is in text value that I want to graph over time.
index=pcrf sourcetype=rac* ha_state=* | table _time ha_state host
Where I want to visualize the text(ha_state) by host, it will be one of 3 values (King, Master, Slave). I didn't make up the values, the vendor did.
Try this ...
index=pcrf sourcetype=rac* ha_state=*
| fields _time ha_state host
| Eval ShowState=case( ha_state="Slave", 1, ha_state="Master", 3 , ha_state="King", 7)
| timechart avg(ShowState) as state by host
At any given span of _time
, the host on the top line will be King, the next Master, and any on the bottom will be Slave. If a host changes state during the span, then the reading will show somewhere in between.
We've adjusted the scale 1-3-7 so that any switches from top-bottom or bottom-top (Slave+King) are unlikely to land exactly on the middle (Master). If you prefer, you can adjust them to 1-3-4 or whatever.