topic Re: How to display duration(start and end time) in a column chart? in Splunk Search

How to display duration(start and end time) in a column chart?

mythili — Thu, 12 Sep 2024 14:15:14 GMT

Hi all,

I am trying to show the connected duration, which is calculated using transaction command in a timechart. When I try below query, the entire duration shows in the earliest timestamp(start time) as a single column. I would like to show the connected duration in a column chart, with area between start and end time colored. For example, if device was connected from 20th August to 23rd August, I want the column to extend across these days. Currently, the entire duration is shown on the 20th date alone. Kindly let me know your suggestions to implement this.

Query:

| transaction dvc_id startswith="CONNECTED" endswith="DISCONNECTED" | timechart sum(duration) by connection_protocol

Re: How to display duration(start and end time) in a column chart?

norbertomyrna — Thu, 12 Sep 2024 05:04:35 GMT

Right-click on the chart area and choose Select Data. Click Add and enter Duration as the series name. Select cells E5:E11 as the series values and click OK. The Edit Series window will reappear. Click OK. Click OK on the Select Data Source window. The duration will be added to the chart.

Re: How to display duration(start and end time) in a column chart?

norbertomyrna — Thu, 12 Sep 2024 05:05:54 GMT

hey there!!

Re: How to display duration(start and end time) in a column chart?

gcusello — Thu, 12 Sep 2024 06:09:11 GMT

Hi @mythili ,

to acquire your requirement it isn't possible with the default visualizations, but you could try with the Splunk Timeline - custom visualization (https://splunkbase.splunk.com/app/3120) add-on, following the instructions about how to create your search.

Ciao.

Giuseppe

Re: How to display duration(start and end time) in a column chart?

yuanliu — Thu, 12 Sep 2024 06:10:44 GMT

What you ask is effectively a Gantt chart visualization that Splunk search and dashboard doesn't support natively. Checkout this viz app: https://splunkbase.splunk.com/app/3120.

(Years ago I got some help here for similar - a lot of filldown and stuff. Using a prebuilt app is perhaps the best way to go for now.)

Re: How to display duration(start and end time) in a column chart?

PickleRick — Thu, 12 Sep 2024 06:21:13 GMT

You need to look for a different visualization. Bar chart, line chart and such are meant for showing discrete values, not time ranges.

For starters - you can check out this app https://splunkbase.splunk.com/app/3120 (I'm not saying that's what fits your use case but that's at least one possible approach).