Dashboards & Visualizations

Graph path

Timeago
Explorer

Hello!

I need to make graph path for the field "Status".

1st step:




































time Name Status
... Name1 A
... Name2 B
... Name1 C
... Name1 A
... Name2 A

2nd step:

...|sort 0 Name time

time Name Status
... Name1 A
... Name1 C
... Name1 A
... Name2 B
... Name2 A

3rd step:

time Name Status Previous_Status
... Name1 A C
... Name1 C A
... Name1 A
... Name2 B A
... Name2 A

So, how can i make the 3rd step?
Or suggest another way to solve this problem?

Thank you

Tags (2)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi Timeago

you should be able to get this by using streamstats

The streamstats command, similar to the stats command, calculates summary statistics on search results. Unlike, stats (which works on the results as a whole), streamstats calculates statistics for each event at the time the event is seen.

Combined with eval you can make new fields and compare them to each other.

Hope this helps to get you started...........

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi Timeago

you should be able to get this by using streamstats

The streamstats command, similar to the stats command, calculates summary statistics on search results. Unlike, stats (which works on the results as a whole), streamstats calculates statistics for each event at the time the event is seen.

Combined with eval you can make new fields and compare them to each other.

Hope this helps to get you started...........

cheers, MuS

kristian_kolb
Ultra Champion

Hmmm.. maybe. try this as a start.. not tested..

... | sort +Name, +_time | streamstats window=1 current=false first(Status) as Previous_Status

/K

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...