topic Vizualizing Application Start End Times in All Apps and Add-ons

Vizualizing Application Start End Times

vivasaayi — Mon, 28 Sep 2020 14:53:40 GMT

I am monitoring 4 applications. Each application is assigned an unique name (like App1, App2) and each running instance will have an instance id (a distinct GUID - SVID) and I am logging when they are started and stopped. I am able to get the duration, start time and end times of applications using the following query.

| where like (MESSAGE, "%Started%") or like (MESSAGE, "%Disposed%") | transaction SVID | eval starttime=strftime(_time, "%D %H:%M:%S") | eval endtime= strftime(_time+duration, "%D %H:%M:%S") | table SVID starttime duration endtime

The table looks fine.

    APP     SVID                                    Start Time          Duration    End Time
1   App1    3f3c74bf-375b-4442-bd38-b6a22092a2c2    10/04/13 12:26:11   2.646   10/04/13 12:26:13
2   App1    0705742b-4d45-4203-8229-4f1571952a49    10/04/13 12:25:24   13.066  10/04/13 12:25:38
3   App2    5ae6483e-7e24-4f0b-93f1-7c1c0bd94c49    10/04/13 10:54:25   0       10/04/13 10:54:25

I am tying to create a Chart, which shows the start and end times as follows.

|
|       ****************************************    **********          ***************
|
|       ======= ====    ====    =====   =============================== =======
|
|       ++++++++        ++++++++++++++++++++++++++              ++++    +++++++++   ++++++
|
|
|_______________________________________________________________________________________________
                            Time

* - App1
= - App2
+ - App3

Could you please help?

Re: Vizualizing Application Start End Times

adrianfowler — Thu, 12 Dec 2013 09:56:59 GMT

Did you have success with this? As I am trying to do the same thing!

Re: Vizualizing Application Start End Times

yoho — Thu, 23 Jan 2014 14:18:18 GMT

Me too. I think it's not very trivial given the visualization tools of splunk. In the end, it comes down to making the timechart of a field whose value is 1 when your process is up and 0 when it's down. I'm also trying to make a chart similar to this one (well, less elaborate): http://www.bootchart.org/images/bootchart.png

Re: Vizualizing Application Start End Times

duraij — Sat, 28 Jan 2017 19:36:20 GMT

Were you able to achieve this I am trying to do the same thing.Please let me know

Re: Vizualizing Application Start End Times

yoho — Mon, 30 Jan 2017 08:31:30 GMT

Hello, I have not yet found time to create this chart (low priority here) but I found this viz app which could reveal quite useful to create such a dashboard: https://splunkbase.splunk.com/app/1741/