Splunk - How do i build a timeline chart to trace a transaction that has multiple asynchronous processes

eplate — Mon, 02 Jul 2018 13:35:32 GMT

I would like to create a timeline view that shows the begin/end time of every event for a given transaction. The transaction is a series of automated/asynchronous processes that run from a single CreateJob request. I want essentially see a bar chart of the events where the x-axis is the "wall clock" and the y-axis is a list of events.

For each event, we have the following data points:
transactionId => links all the different events together
actionName => the name of the event that is being logged
beginTime
endTime

Sample Data:

timestamp=2018/07/02 12:00:10.572;actionName=ConcludeJob;application=10002;beginTime=2018/07/02 12:00:10.353;endTime=2018/07/02 12:00:10.572;transactionId=123;
timestamp=2018/07/02 12:00:10.345;actionName=storeFile;application=10002;beginTime=2018/07/02 12:00:10.230;endTime=2018/07/02 12:00:10.345;transactionId=123;
timestamp=2018/07/02 12:00:10.201;actionName=retrieveItem;application=10002;beginTime=2018/07/02 12:00:10.172;endTime=2018/07/02 12:00:10.201;transactionId=123;
timestamp=2018/07/02 12:00:05.154;actionName=CreateJob;application=10002;beginTime=2018/07/02 12:00:05.144;endTime=2018/07/02 12:00:05.154;transactionId=123;

What I would like to do is to build a timeline dashboard visualization that has the "wall clock" as the x-axis, each event as a line on the y-axis and then a bar for each event that plots the beginning of the bar as when the event started, the end of the bar as when it ended. This way I could see what all is happening in parallel and which events are the "long pole".

Here is an example of what I am looking for:

https://images.template.net/wp-content/uploads/2015/07/Timeline-Chart-With-Overlapping-Event-Excel-Download.jpg
[unfortunately, I am new, so I may not be able to put the image right in here]

The difference is that in my chart, i would have the following from my sample data:
y-axis:

- CreateJob
- retrieveItem
- storeFile
- ConcludeJob

x-axis:
- Hour:Minute:Second.millisecond

Thanks!

Re: Splunk - How do i build a timeline chart to trace a transaction that has multiple asynchronous processes

niketn — Mon, 02 Jul 2018 14:20:51 GMT

@eplate try out the Timeline Custom Visualization

Re: Splunk - How do i build a timeline chart to trace a transaction that has multiple asynchronous processes

eplate — Mon, 02 Jul 2018 17:53:53 GMT

Thanks - I will see if the admin will install this for me and then try it out. It looks exactly like what I need.

topic Re: Splunk - How do i build a timeline chart to trace a transaction that has multiple asynchronous processes in Splunk Search

Splunk - How do i build a timeline chart to trace a transaction that has multiple asynchronous processes

Re: Splunk - How do i build a timeline chart to trace a transaction that has multiple asynchronous processes

Re: Splunk - How do i build a timeline chart to trace a transaction that has multiple asynchronous processes