Splunk Search

How To Create a Date Chart Per Source?

vtsguerrero
Contributor

I have a dynamic field that is the length of an event, it's currently generated by the eval length = (end_time - start_time).

The problem is, that it's almost like a timechart, but not a timechart.
It should show in the Y-Axis, Splunk Time Progression, and in the X-Axis, Name Of Each Source (event).
Inside the graph, events should be placed with the length created by these events.
Here is my current search:

index=full sourcetype=temp DATA_INICIO=* DATA_FIM=* PROCESS_NAME=*
| eval LENGTH = (START_DATE - END_DATE) 
| eval LENGTH = strptime( LENGTH, "%d/%m/%Y-%T")   
| stats first(LENGTH) by source

This graphic would demonstrate length of these events only by hour-minute-second, date is not required.
I was using chart or timechart, but it was actually counting the events, and not only displaying them.
Can anyone help me with this similar like timechart?
Thanks in advance!

0 Karma

Richfez
SplunkTrust
SplunkTrust

Have you looked at the Gantt chart app?
https://apps.splunk.com/app/1741/
It might give you the chart you want.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...