I'd like to create a visualization showing the connected state of a hand full of clients.
We log connected state as "ClientID=nnnn - Connected" ... "ClientID=nnnn - Unreachable"
My search is as follows
index=blah "Connected" OR "Unreachable" | transaction ClientID startswith="Connected" endswith="Unreachable" | eval durationstr = tostring(duration,"duration") | table ClientID, durationstr, _time
how can I use transactions as a boolean to create a nice visualization showing client connectivity in a timechart?
↧