I have to do a special chart, but I am encoutering some troubles

[nugetchar]

Hi everyone,

I'm posting here because of this:
I have a csv-file like this:

Thread, start_time_ms, duration

2, 1360576197790, 13500

10, 1360576211291, 91

4, 1360576195361, 16021

9, 1360576209301, 2904

16, 1360576212873, 316

15, 1360576198724, 14465

11, 1360576211387, 3703

14, 1360576213198, 5348

13, 1360576212205, 7254

12, 1360576219460, 177

8, 1360576209300, 10337

5, 1360576219643, 2709

6, 1360576215091, 9610

7, 1360576224702, 90

4, 1360576211386, 13407

1, 1360576218547, 7470

3, 1360576226018, 90

4, 1360576213195, 12913

7, 1360576224800, 2437

And, that I want to do is to timechart the number of active-Thread during the time. It means that I don't want only the Thread which activate for a instant "t", but those which are already activated too.

Any idea?

Thanks in advance 😉

Nugetchar

[martin_mueller]

Consider this as a line chart with nullvalues as "connect":

| inputlookup test.csv | eval _time = start_time_ms/1000 | eval duration_s = duration/1000 | concurrency duration=duration_s | timechart avg(concurrency)

test.csv is your file of course, CBA to index it 😛

[martin_mueller]

Have you tried to use it like I used it?

[nugetchar]

You're right, I forgot to take in count the duration but I don't know how to use it with the concurrency...

[martin_mueller]

Going by your example, why are you ignoring the duration field from your data?

[nugetchar]

Thanks you two very much, I almost have the expect result with this:

index="dashboards" Step=0 | delta _time AS timeDelta p=5 | eval timeDelta=abs(timeDelta) | concurrency duration=timeDelta | timechart avg(concurrency) as ThreadsActifsEnMoyenne

But there is something missing... Any idea?

[BDAS]

Hi Nugetchar,

I don't know the answer, but maybe you could try something like this to start with:

stats min(start_time_ms) as FirstStarted, max(eval(start_time_ms + duration)) as LastFinished by Thread

I assume you need to visualize the growth and the decreasing of your activated threads, and maybe a stagnating phase where all threads are activated.

Hope it gives you some ideas, I'm quite new with Splunk 😃

Let me know if you find it out!

BlueLychee