Hi everyone,
I'm posting here because of this:
I have a csv-file like this:
Thread, start_time_ms, duration
2, 1360576197790, 13500
10, 1360576211291, 91
4, 1360576195361, 16021
9, 1360576209301, 2904
16, 1360576212873, 316
15, 1360576198724, 14465
11, 1360576211387, 3703
14, 1360576213198, 5348
13, 1360576212205, 7254
12, 1360576219460, 177
8, 1360576209300, 10337
5, 1360576219643, 2709
6, 1360576215091, 9610
7, 1360576224702, 90
4, 1360576211386, 13407
1, 1360576218547, 7470
3, 1360576226018, 90
4, 1360576213195, 12913
7, 1360576224800, 2437
And, that I want to do is to timechart the number of active-Thread during the time. It means that I don't want only the Thread which activate for a instant "t", but those which are already activated too.
Any idea?
Thanks in advance 😉
Nugetchar
Consider this as a line chart with nullvalues as "connect":
| inputlookup test.csv | eval _time = start_time_ms/1000 | eval duration_s = duration/1000 | concurrency duration=duration_s | timechart avg(concurrency)
test.csv is your file of course, CBA to index it 😛
Have you tried to use it like I used it?
You're right, I forgot to take in count the duration but I don't know how to use it with the concurrency...
Going by your example, why are you ignoring the duration field from your data?
Thanks you two very much, I almost have the expect result with this:
index="dashboards" Step=0 | delta _time AS timeDelta p=5 | eval timeDelta=abs(timeDelta) | concurrency duration=timeDelta | timechart avg(concurrency) as ThreadsActifsEnMoyenne
But there is something missing... Any idea?
Hi Nugetchar,
I don't know the answer, but maybe you could try something like this to start with:
stats min(start_time_ms) as FirstStarted, max(eval(start_time_ms + duration)) as LastFinished by Thread
I assume you need to visualize the growth and the decreasing of your activated threads, and maybe a stagnating phase where all threads are activated.
Hope it gives you some ideas, I'm quite new with Splunk 😃
Let me know if you find it out!
BlueLychee