Splunk Search

How to build a chronological event list

cpressl
New Member

I have an index that lists (among other things) a device, event date, and level (1-4). Devices change levels at random intervals. I need to build a search that shows how long a particular device has been at a certain level, but I can't do a simple count; if a device is at level 1 for three days, goes to level 2 for five days, then back to level 1 for two days, a count will show five days which is obviously incorrect. How can I generate a 'Consecutive days at current level' field?

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...