Timeline visualization using attributes of an single event

Hung_Nguyen — Fri, 12 Nov 2021 03:07:19 GMT

In order to visual a data table with 4 columns: time, resource1, resource2, duration. I know who to do this with data coming from different events. However in my case, all the data is stored in a single performance metric splunk event. The event would look like the blob below where measureStart node contains the start time of these tasks, and the measure node contains the durations of these tasks

Splunk Event:

{
measureStart: {
"super_Task1: mini task1": 2021-11-12T02:50:05.430Z,
"super_Task1: mini task2": 2021-11-12T02:50:06.430Z,
"super_Task2: mini task1": 2021-11-12T02:50:07.430Z,
},
measures: {
"super_Task1: mini task1": 50,
"super_Task1: mini task2": 100,
"super_Task2: mini task1": 80,
}
}

I would like to produce a table that looks like this
time supertasks tasks duration
2021-11-12T02:50:05.430Z super_Task1 point1 50
2021-11-12T02:50:06.430Z super_Task1 point2 100
2021-11-12T02:50:07.430Z super_Task2 point1 80

thank you very much!

Re: Timeline visualization using attributes of an single event

ITWhisperer — Fri, 12 Nov 2021 09:52:48 GMT

| makeresults | eval _raw="{ \"measureStart\": { \"super_Task1: mini task1\": \"2021-11-12T02:50:05.430Z\", \"super_Task1: mini task2\": \"2021-11-12T02:50:06.430Z\", \"super_Task2: mini task1\": \"2021-11-12T02:50:07.430Z\" }, \"measures\": { \"super_Task1: mini task1\": 50, \"super_Task1: mini task2\": 100, \"super_Task2: mini task1\": 80 } }" | spath measureStart | spath measures | spath input=measureStart | spath input=measures | fields - _raw measureStart measures | untable _time task values | rex field=values max_match=0 "(?<values>\S+)" | eval supertask=mvindex(split(task,":"),0) | eval task=trim(mvindex(split(task,":"),1)) | eval _time=strptime(mvindex(values,0),"%Y-%m-%dT%H:%M:%S.%QZ") | eval duration=mvindex(values,1) | fields - values

topic Timeline visualization using attributes of an single event in Splunk Search

Timeline visualization using attributes of an single event

Re: Timeline visualization using attributes of an single event