I have a dynamic field that is the length of an event, it's currently generated by the eval length = (end_time - start_time)
.
The problem is, that it's almost like a timechart, but not a timechart.
It should show in the Y-Axis, Splunk Time Progression, and in the X-Axis, Name Of Each Source (event).
Inside the graph, events should be placed with the length created by these events.
Here is my current search:
index=full sourcetype=temp DATA_INICIO=* DATA_FIM=* PROCESS_NAME=*
| eval LENGTH = (START_DATE - END_DATE)
| eval LENGTH = strptime( LENGTH, "%d/%m/%Y-%T")
| stats first(LENGTH) by source
This graphic would demonstrate length of these events only by hour-minute-second, date is not required.
I was using chart or timechart, but it was actually counting the events, and not only displaying them.
Can anyone help me with this similar like timechart?
Thanks in advance!
Have you looked at the Gantt chart app?
https://apps.splunk.com/app/1741/
It might give you the chart you want.