Line chart with different events

Kaviyap — Mon, 07 May 2018 11:55:15 GMT

I have a splunk log in following format:

||pool-2-thread-1|| INFO  SUCCESSFULLY COMPLETED at END_TIME: 2018-05-07T06:05:17.475Z 

||pool-2-thread-1|| INFO ACTIVE at START_TIME: 2018-05-07T06:04:44.981Z 

||pool-2-thread-1|| INFO SUCCESSFULLY COMPLETED at END_TIME: 2018-05-09T07:10:17.475Z 

||pool-2-thread-1|| INFO ACTIVE at START_TIME: 2018-05-09T07:08:44.981Z

all the above are separate events. Now I want to get the start date and end date as follows:

startDate                                    Enddate
-------------------------------------------------------
 2018-05-09T07:08:44.981Z   2018-05-09T07:10:17.475Z
2018-05-07T06:04:44.981Z    2018-05-07T06:05:17.475Z

and I need to draw a timechart with the data. Am new to the splunk, can anyone please suggest me how can I do it.

Re: Line chart with different events

xpac — Mon, 07 May 2018 16:19:50 GMT

Are these events always in the right order, e.g. start, end, start, end, etc?

Re: Line chart with different events

woodcock — Mon, 07 May 2018 17:59:16 GMT

To do what Splunk calls timechart, you only need 1 value. What do you mean by timechart and why do you need both values?

topic Line chart with different events in Splunk Search

Line chart with different events

Re: Line chart with different events

Re: Line chart with different events