All Apps and Add-ons

Vizualizing Application Start End Times

vivasaayi
Engager

I am monitoring 4 applications. Each application is assigned an unique name (like App1, App2) and each running instance will have an instance id (a distinct GUID - SVID) and I am logging when they are started and stopped. I am able to get the duration, start time and end times of applications using the following query.

  • | where like (MESSAGE, "%Started%") or like (MESSAGE, "%Disposed%") | transaction SVID | eval starttime=strftime(_time, "%D %H:%M:%S") | eval endtime= strftime(_time+duration, "%D %H:%M:%S") | table SVID starttime duration endtime

The table looks fine.

    APP     SVID                                    Start Time          Duration    End Time
1   App1    3f3c74bf-375b-4442-bd38-b6a22092a2c2    10/04/13 12:26:11   2.646   10/04/13 12:26:13
2   App1    0705742b-4d45-4203-8229-4f1571952a49    10/04/13 12:25:24   13.066  10/04/13 12:25:38
3   App2    5ae6483e-7e24-4f0b-93f1-7c1c0bd94c49    10/04/13 10:54:25   0       10/04/13 10:54:25

I am tying to create a Chart, which shows the start and end times as follows.

|
|       ****************************************    **********          ***************
|
|       ======= ====    ====    =====   =============================== =======
|
|       ++++++++        ++++++++++++++++++++++++++              ++++    +++++++++   ++++++
|
|
|_______________________________________________________________________________________________
                            Time

* - App1
= - App2
+ - App3

Could you please help?

yoho
Contributor

Hello, I have not yet found time to create this chart (low priority here) but I found this viz app which could reveal quite useful to create such a dashboard: https://splunkbase.splunk.com/app/1741/

0 Karma

duraij
Explorer

Were you able to achieve this I am trying to do the same thing.Please let me know

0 Karma

yoho
Contributor

Me too. I think it's not very trivial given the visualization tools of splunk. In the end, it comes down to making the timechart of a field whose value is 1 when your process is up and 0 when it's down. I'm also trying to make a chart similar to this one (well, less elaborate): http://www.bootchart.org/images/bootchart.png

0 Karma

adrianfowler
New Member

Did you have success with this? As I am trying to do the same thing!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...