topic Re: How to create user logon session line chart by timechart command in Dashboards & Visualizations

How to create user logon session line chart by timechart command

p2akira — Fri, 04 Dec 2020 15:53:54 GMT

Hi all,

I have data in below that indicates logon and logoff time.

_time	user	startTime	endTime
20/12/04 18:07:03.000	A	1607072823	1607073562
20/12/04 17:53:22.000	B	1607072002	1607074229
20/12/04 16:21:19.000	A	1607066479	1607066494
20/12/04 16:07:32.000	C	1607065652	1607065719

"_time" is equal to startTime but startTime is epoch time.

I would like to plot this time series data to line chart using timechart command.

Like, x axis indicates time with 1minutes span, and y axis indicates each user name and plot data to be 1 between session startTime and endTime.

Re: How to create user logon session line chart by timechart command

gcusello — Fri, 04 Dec 2020 16:03:05 GMT

Hi @p2akira,

To do what you like, you should explore the timeline Visualization https://splunkbase.splunk.com/app/3120/

Ciao.

Giuseppe

Re: How to create user logon session line chart by timechart command

p2akira — Fri, 04 Dec 2020 16:08:54 GMT

Hi @gcusello ,

Thank you your app suggestions

I'm aware of that app, but I can't install it because our Splunk is deployed on a closed network or can't bring app packaged file.
Therefore, I would like to implement it by using the line chart that I can use by default.

Thank you.

Re: How to create user logon session line chart by timechart command

to4kawa — Sat, 05 Dec 2020 04:38:07 GMT

index=_internal | head 1 | fields _raw | eval _raw="_time user startTime endTime 20/12/04 18:07:03.000 A 1607072823 1607073562 20/12/04 17:53:22.000 B 1607072002 1607074229 20/12/04 16:21:19.000 A 1607066479 1607066494 20/12/04 16:07:32.000 C 1607065652 1607065719" | multikv forceheader=1 | rex "(?<time>\S+ \S+)\s+(?<user>\w)\s+(?<startTime>\d+)\s+(?<endTime>\d+)" | eval _time=strptime(time,"%y/%m/%d %T.%3Q") | eval time=mvrange(startTime,endTime,60) | mvexpand time | stats count by time user | rename time as _time | timechart span=1min cont=f count by user

try column chart with stack

Re: How to create user logon session line chart by timechart command

p2akira — Mon, 07 Dec 2020 06:18:11 GMT

Thank you!

That's what I wanted to do.