yes I tried, almost got it. one issue remaining is I have to show separate timeline for each event, not overlapped.
Query:
/source/ | rename "Date Event Began" AS start_date | rename "Date of Restoration" AS end_date | rename "Time Event Began" AS start_time | rename "Time of Restoration" AS end_time | eval _time = strptime(start_date." ".start_time, "%m/%d/%Y %H:%M") | eval end_time = strptime(end_date." ".end_time, "%m/%d/%Y %H:%M") | eval duration = (end_time - _time) * 1000 |stats count by _time, Track, duration, "job" | table _time "Track" "job" duration
I want to skip Track and display separate timeline for each job in that track hence avoiding overlap
... View more