topic Re: Line Chart Time Between Two Searched Fields in Splunk Search

Line Chart Time Between Two Searched Fields

chrisboy68 — Fri, 24 Apr 2015 15:19:04 GMT

Hi, This should be easy, but I'm getting confused making it work. I have the following:

Time: 01:00 PM Event: STARTED
Time: 01:35 PM Event: STOPPED
TIme: 04:00 PM Event: STARTED
Time: 04:30 PM Event: STOPPED

Given I have two fields, Time and Event. I want a solid line chart showing the range of time an Event STARTED and an Event STOPPED.

Any pointers?

Thank you,

Chris

Re: Line Chart Time Between Two Searched Fields

lguinn2 — Fri, 24 Apr 2015 16:37:36 GMT

It's actually not that easy for Splunk. A timechart has a continuous timeline across the x-axis. But what Splunk sees with these 4 events is simply 4 points in time, with nothing in between. So you could do a chart, but how would Splunk know to fill in at 1:01 but not at 1:40? Also, you really need an event identifier - what if events overlap?

So try this

yoursearchhere
| eval TT=_time 
| transaction startswith="STARTED" endswith="STOPPED"
| streamstats count AS ID
| table _time TT ID
| mvexpand TT
| eval _time=TT
| timechart  values(ID) by ID

You will need to use a line chart, and in the options, choose to "connect missing values". This may not work exactly, but hopefully it will get close to what you want.

Re: Line Chart Time Between Two Searched Fields

andrey2007 — Fri, 24 Apr 2015 16:37:43 GMT

Try to use transaction something like this ...
...| eval newfield="newfield"| transaction newfield startswith="STARTED" endswith="stoped" | table duration
it will give you autogenerated duration field (range between stopped and started)

oh, I was late with answer publication for 1 minute

Re: Line Chart Time Between Two Searched Fields

chrisboy68 — Thu, 14 May 2015 11:27:12 GMT

Thank you very much for the response. I'm going to dig into both suggestions!

Chris