topic Timeline App duration problem in Splunk Search

Timeline App duration problem

MaryvonneMB — Wed, 11 May 2016 09:10:58 GMT

Hi everyone!

I'm trying to use Timeline module but I have some trouble with the duration:
Note: I'm working with a lookup file

So, I have start and end contract date for some object, and obviously, I would like to see on a timeline when a contract start and end.
I do the following:
convert timeformat=%Y-%m-%d mktime(timeDate) mktime(endDate) | eval diff=(endDate-timeDate) |table timeDate, "Contract #", diff
I have a timeline but, for example: I have a contract starting at 2009-10-01 and ending at 2014-10-31. The diff value in seconds is correct but, on the timeline it represent only 1day. I don't understand where the problem is. (By the way, every starting date is correctly put on the timeline

Thanks in advance

Re: Timeline App duration problem

woodcock — Wed, 11 May 2016 16:22:18 GMT

What visualization are you using?

Re: Timeline App duration problem

MaryvonneMB — Thu, 12 May 2016 06:56:48 GMT

I'm using the Timeline - Custom Vizualisation App from Splunk 6.4

Re: Timeline App duration problem

MaryvonneMB — Thu, 12 May 2016 13:32:43 GMT

In fact, a collegue help me and find that we have to do the following: eval diff=(endDate-timeDate) * 1000
With this multiplication the results are well design. But he doesn't know why we have to do this. If anyone has an idea, the answer will be welcome!

Re: Timeline App duration problem

chchu_splunk — Fri, 25 Jan 2019 15:05:38 GMT

Late answer to an old post.

I had the same issue and it appears that the duration requires the resulting field in milliseconds rather than seconds, so multiplying your result by 1000 makes it work.

https://docs.splunk.com/Documentation/Timeline/1.3.0/TimelineViz/TimelineSearchDataFormat