https://community.splunk.com/t5/Splunk-Cloud-Platform/Unable-to-get-the-correct-visualization/m-p/564577#M1058 <P>I have been editing the following query in order to get the duration for workload.....how ever while creating the visualization we only see duration of the bar chart......i am looking to see if we can get something with regards to the workload and/0r Jobname.</P><P>| inputlookup cyclestarttimes.csv<BR />| lookup cycleendtimes.csv CYCLE WORKLOAD<BR />| search WORKLOAD=F91<BR />| where isnotnull(ENDTIME)<BR />| eval STARTC = "2021-08-19"<BR />| eval ENDC = "2021-08-20"<BR />| eval STARTC = strptime(STARTC, "%Y-%m-%d")<BR />| eval ENDC = strptime(ENDC, "%Y-%m-%d")<BR />| eval CYCLEC = strptime(CYCLE, "%Y-%m-%d")<BR />| where CYCLEC &gt;= STARTC AND CYCLEC &lt;= ENDC<BR />| stats values(STARTTIME) as START values(ENDTIME) as STOP by WORKLOAD CYCLE<BR />| eval _time = strptime(START, "%Y-%m-%d %H:%M:%S")<BR />| eval end_time = strptime(STOP, "%Y-%m-%d %H:%M:%S")<BR />| eval duration = (end_time - _time) * 1000<BR />| eval JOBNAME = WORKLOAD<BR />| stats count by _time,duration, WORKLOAD, JOBNAME<BR />| table _time WORKLOAD JOBNAME duration</P> Tue, 24 Aug 2021 16:14:04 GMT chinmay25 2021-08-24T16:14:04Z https://community.splunk.com/t5/Splunk-Cloud-Platform/Unable-to-get-the-correct-visualization/m-p/564577#M1058 <P>I have been editing the following query in order to get the duration for workload.....how ever while creating the visualization we only see duration of the bar chart......i am looking to see if we can get something with regards to the workload and/0r Jobname.</P><P>| inputlookup cyclestarttimes.csv<BR />| lookup cycleendtimes.csv CYCLE WORKLOAD<BR />| search WORKLOAD=F91<BR />| where isnotnull(ENDTIME)<BR />| eval STARTC = "2021-08-19"<BR />| eval ENDC = "2021-08-20"<BR />| eval STARTC = strptime(STARTC, "%Y-%m-%d")<BR />| eval ENDC = strptime(ENDC, "%Y-%m-%d")<BR />| eval CYCLEC = strptime(CYCLE, "%Y-%m-%d")<BR />| where CYCLEC &gt;= STARTC AND CYCLEC &lt;= ENDC<BR />| stats values(STARTTIME) as START values(ENDTIME) as STOP by WORKLOAD CYCLE<BR />| eval _time = strptime(START, "%Y-%m-%d %H:%M:%S")<BR />| eval end_time = strptime(STOP, "%Y-%m-%d %H:%M:%S")<BR />| eval duration = (end_time - _time) * 1000<BR />| eval JOBNAME = WORKLOAD<BR />| stats count by _time,duration, WORKLOAD, JOBNAME<BR />| table _time WORKLOAD JOBNAME duration</P> Tue, 24 Aug 2021 16:14:04 GMT https://community.splunk.com/t5/Splunk-Cloud-Platform/Unable-to-get-the-correct-visualization/m-p/564577#M1058 chinmay25 2021-08-24T16:14:04Z