Splunk Search

Line Chart Time Between Two Searched Fields

chrisboy68
Contributor

Hi, This should be easy, but I'm getting confused making it work. I have the following:

Time: 01:00 PM Event: STARTED
Time: 01:35 PM Event: STOPPED
TIme: 04:00 PM Event: STARTED
Time: 04:30 PM Event: STOPPED

Given I have two fields, Time and Event. I want a solid line chart showing the range of time an Event STARTED and an Event STOPPED.

Any pointers?

Thank you,

Chris

0 Karma

andrey2007
Contributor

Try to use transaction something like this ...
...| eval newfield="newfield"| transaction newfield startswith="STARTED" endswith="stoped" | table duration
it will give you autogenerated duration field (range between stopped and started)

oh, I was late with answer publication for 1 minute

0 Karma

chrisboy68
Contributor

Thank you very much for the response. I'm going to dig into both suggestions!

Chris

0 Karma

lguinn2
Legend

It's actually not that easy for Splunk. A timechart has a continuous timeline across the x-axis. But what Splunk sees with these 4 events is simply 4 points in time, with nothing in between. So you could do a chart, but how would Splunk know to fill in at 1:01 but not at 1:40? Also, you really need an event identifier - what if events overlap?

So try this

yoursearchhere
| eval TT=_time 
| transaction startswith="STARTED" endswith="STOPPED"
| streamstats count AS ID
| table _time TT ID
| mvexpand TT
| eval _time=TT
| timechart  values(ID) by ID

You will need to use a line chart, and in the options, choose to "connect missing values". This may not work exactly, but hopefully it will get close to what you want.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...