Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How can I carry over field values into future time buckets?

$
0
0
I have three fields: order_number, status, and a timestamp for when that status became effective. There are three statuses - ready, in_progress, and complete. I need to create a dashboard that provides a monthly count for how many orders are in each status by month with a drill-down that will show the order numbers for a clicked status / month. I need help with the SPL to rearrange my data so that I can carry over the order_number and status into the following monthly time buckets. There are time gaps between status changes. Example, time is bin span=1mon: Order_Number - Status - _time 1 - ready - 201812 2 - ready - 201901 1 - in_progress - 201903 2 - in_progress - 201905 1 - complete - 201906 2 - complete - 201906 Looking for: 1- ready - 201812 1 - ready - 201901 2 - ready - 201901 1 - ready - 201902 2 - ready - 201902 1 - in_progress - 201903 2 - ready - 201903 1 - in_progress - 201904 2 - ready - 201904 1 - in_progress - 201905 2 - in_progress - 201905 1 - complete - 201906 2 - complete - 201906

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>