Splunk Search

How can I create a chart with the range start and end date in the y-axis?

venkatsivab
New Member

Example data :

start_date end_date batch_name
2017-11-18 12:12:13 2017-11-18 15:12:13 job1
2017-11-18 10:12:13 2017-11-18 12:12:13 job2

I have to create a chart where the x-axis contains the timechart span=1d by batch_nm and y axis should display the range start_date and end_date data so that we can see when the job1 started and job1 ended.

0 Karma

woodcock
Esteemed Legend

Like this:

| makeresults 
| eval raw="2017-11-18 12:12:13 2017-11-18 15:12:13 job1::2017-11-18 10:12:13 2017-11-18 12:12:13 job2"
| makemv delim="::" raw
| mvexpand raw
| rename raw AS _raw
| rex "^(?<start_date>\S+\s+\S+)\s+(?<end_date>\S+\s+\S+)\s+(?<job_id>\S+)$"
| fields - _raw

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| eval start_date = strptime(start_date, "%Y-%m-%d %H:%M:%S")
| eval end_date = strptime(end_date, "%Y-%m-%d %H:%M:%S")
| eval _time = start_date
| fieldformat start_date=strftime(start_date, "%Y-%m-%d %H:%M:%S")
| fieldformat end_date=strftime(end_date, "%Y-%m-%d %H:%M:%S")
| eval duration = end_date - start_date
| rename COMMENT AS "to convert to minutes, add '| eval duration=duration/60'"
| rename COMMENT AS "to convert to hours, add '| eval duration=duration/(60*60)'"
| timechart avg(duration) AS duration BY job_id
0 Karma

DalJeanis
Legend

If you need that, here's one easy way:

1) Convert the start time to decimal hours after midnight.
2) Calculate the duration of the job in decimal hours.
3) Present the results as a stacked bar chart with the start time on the bottom and the duration on top.

0 Karma

shugup2923
Path Finder

How can we Present the results as a stacked bar chart with the start time on the bottom and the duration on top.
can you please help ?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...