https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-graph-the-duration-scripts-ran-using/m-p/187099#M53940 <P>Your question is too vague but this should get you started:</P> <PRE><CODE>... | rex "^\W+\w+\W+\w+(?&lt;Report&gt;\W+)\w+(?&lt;BeginOrFinished&gt;\W+)\w+(?&lt;Procedure&gt;.*)$" | where BeginOrFinished="Begin" | timechart ... </CODE></PRE> Tue, 30 Jun 2015 18:20:01 GMT woodcock 2015-06-30T18:20:01Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-graph-the-duration-scripts-ran-using/m-p/187098#M53939 <P>Right now I have two different scripts: report scripts and procedure scripts. They have a begin and finished time. I am trying to create a graph using the time as the y-axis and the report as the x-axis and the procedure as x-axis on another graph. Example text would be...</P> <PRE><CODE>2012-03-22 00:7:02,318 INFORMATION Begin Procedure Script 2012-03-22 00:8:02,318 INFORMATION FINISHED Procedure Script (0) </CODE></PRE> Tue, 30 Jun 2015 17:43:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-graph-the-duration-scripts-ran-using/m-p/187098#M53939 alanxu 2015-06-30T17:43:08Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-graph-the-duration-scripts-ran-using/m-p/187099#M53940 <P>Your question is too vague but this should get you started:</P> <PRE><CODE>... | rex "^\W+\w+\W+\w+(?&lt;Report&gt;\W+)\w+(?&lt;BeginOrFinished&gt;\W+)\w+(?&lt;Procedure&gt;.*)$" | where BeginOrFinished="Begin" | timechart ... </CODE></PRE> Tue, 30 Jun 2015 18:20:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-graph-the-duration-scripts-ran-using/m-p/187099#M53940 woodcock 2015-06-30T18:20:01Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-graph-the-duration-scripts-ran-using/m-p/187100#M53941 <P>Is there anything I clarify? But thank you for answering.. I will check what those commands do.</P> Tue, 30 Jun 2015 19:31:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-graph-the-duration-scripts-ran-using/m-p/187100#M53941 alanxu 2015-06-30T19:31:58Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-graph-the-duration-scripts-ran-using/m-p/187101#M53942 <P>What exactly are you trying to chart? I can guess but that is silly! Just for grins, here are a few guesses with answers:</P> <P>To chart the number of jobs completed per Report per hour, do this:</P> <PRE><CODE> ... | rex "^\W+\w+\W+\w+(?&lt;Report&gt;\W+)\w+(?&lt;BeginOrFinished&gt;\W+)\w+(?&lt;Procedure&gt;.*)$" | timechart span=1h count(eval(BeginOrFinished="FINISHED")) AS CompletedJobCount by Report </CODE></PRE> <P>To chart the number of jobs initiated per Procedure per minute, do this:</P> <PRE><CODE> ... | rex "^\W+\w+\W+\w+(?&lt;Report&gt;\W+)\w+(?&lt;BeginOrFinished&gt;\W+)\w+(?&lt;Procedure&gt;.*)$" | timechart span=1m count(eval(BeginOrFinished="Begin")) AS InitiatededJobCount by Procedure </CODE></PRE> Wed, 01 Jul 2015 19:23:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-graph-the-duration-scripts-ran-using/m-p/187101#M53942 woodcock 2015-07-01T19:23:58Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-graph-the-duration-scripts-ran-using/m-p/187102#M53943 <P>I fixed a minor error (re-edited).</P> Wed, 01 Jul 2015 19:23:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-graph-the-duration-scripts-ran-using/m-p/187102#M53943 woodcock 2015-07-01T19:23:59Z