Splunk Search

Plotting a timeline

ryanprayacn
Explorer

Hello:

I have a long row of time and dates for each overall "event". So the data looks like

8/11/2017 18:00:00 8/15/2017 04:00:00 8/19/2017 15:00:00

Can you recommend the best way to plot this information? I'm a little thrown off since I have multiple timestamps in one row.

Thanks!

0 Karma

ryanprayacn
Explorer

This one row represents one timeline for a process. In reality, the row has many more date and times but only listed a sample here for simplicity sake.

0 Karma

DalJeanis
Legend

That depends entirely on what the three different timestamps are, and what information you are trying to impart to the viewer.

If they are the start, midpoint and end of some process, and you want to show how long the process is taking, then perhaps the average durations of the two segments is what you need to plot. Or perhaps you should throw out the middle segments and just plot the overall duration.

If they are the top n times in a race, then maybe the n times need to be plotted as n different horizontal bars, sorted into ascending order.

If they are n different readings that happen to be on a single record, then maybe each one needs to be broken into its own record and plotted as if it had been n records.

So, what are the times representing?

0 Karma

inventsekar
SplunkTrust
SplunkTrust

may you please clarify about the 3 timestamps on the given event, what each timestamp represents.. after understanding this, you can plan for a timeline easily.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...