![]() ![]() I only want to count miles he ran, so I will insist that the speed is above a certain threshold before I want to consider it for totaling. So I might have one event, get one 5 sec later, 4 sec later, 4 sec later, 10 sec later, etc. The events are when the PLC has recorded the sensor data, and they are not evenly spaced. I am trying to take this speed and calculate how far he ran. if my sensor was an endurance runner and then Value would a speed in m/sec, which updates while he is running. By internal convention the units are in the name of the sensor.įor now I am looking at a single sensor-still getting used to splunk. There is a field which identifies the sensor, like a SensorName="Sensor A Units/Unit Time". However, this should work pretty well, I think (note that I reversed the events so that last does the correct thing) also be sure to change the threshholdSpeed value from 10 to whatever is proper: sensor Value># | reverse | eval thresholdSpeed=10 | streamstats current=f last(_time) AS prevTime BY last(Value) AS prevValue BY SensorName | eval duration=_time-prevTime | eval avgSpeed=(Value+prevValue)/2 | eval avgSpeed=if(avgSpeed>=threshholdSpeed, avgSpeed, 0) | eval distance=duration*avgSpeed | stats sum(distance) AS total BY SensorName I think I understand why that is - you're just iterating through the table, so from the computer's perspective that time in between running is multiplied by whatever the rate was when he stopped and then added to the total. The distance total jumps up across the gap. The method provided (in the other thread, linked in my question) for a trapezoidal sum works great if the runner is always running during the time period of interest. So for example if my sensor was an endurance runner and then Value would a speed in m/sec, which updates while he is running. For now I am looking at a single sensor-still getting used to splunk. By internal convention the units are in the name of the sensor. Given the following clarifications, I do not believe there can be a perfect solution: There is a field which identifies the sensor, like a SensorName="Sensor A Units/Unit Time". I am new to splunk, coming from a manufacturing and not a coding background, and trying to figure out how to get splunk to do routine tasks I already do in other programs. The above does not return the correct # of events. sensor Value># | transaction maxpause=2m maxevents=-1 mvlist=_time, Value If I ask mvlist to return the _time value the search breaks down and does not return the correct number of events from the transaction command. I found some examples, but none that needed to use the _time field after applying a transaction. What I can't figure out is how to get the solution I was given to work with transaction data. ![]() Next, I need to be able to do a trapezoidal sum on the values grouped by those transactions, with _time as the x unit. In the set I'm working with this returns 5 transactions. Which will successfully filter the events and group them into continuous runs of good data. I am now trying something like this: sensor Value># | transaction maxpause=2m maxevents=-1 A previous question: solved the problem of how to implement a total, but I found that it didn't work for discontinuous data. I have PLC sensor data in the form unit/unit time that I am trying to totalize over time. When I run a transaction command to group events together, I lose the _time information originally associated with those events. ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |