https://community.splunk.com/t5/Splunk-Search/How-to-display-a-chart-with-search-jobs-and-the-time-range/m-p/306021#M91863 <P>I have some jobs, which have some time frame to run. Every job belongs to some track.<BR /> My purpose is to plot Track vs Time-range chart for those jobs. <BR /> I tried using chart and timechart but they have to have some aggregate function on on axis. In this case it is not necessary.<BR /> Any tips will be helpful!!</P> Mon, 22 May 2017 06:13:46 GMT rvisj 2017-05-22T06:13:46Z https://community.splunk.com/t5/Splunk-Search/How-to-display-a-chart-with-search-jobs-and-the-time-range/m-p/306021#M91863 <P>I have some jobs, which have some time frame to run. Every job belongs to some track.<BR /> My purpose is to plot Track vs Time-range chart for those jobs. <BR /> I tried using chart and timechart but they have to have some aggregate function on on axis. In this case it is not necessary.<BR /> Any tips will be helpful!!</P> Mon, 22 May 2017 06:13:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-a-chart-with-search-jobs-and-the-time-range/m-p/306021#M91863 rvisj 2017-05-22T06:13:46Z https://community.splunk.com/t5/Splunk-Search/How-to-display-a-chart-with-search-jobs-and-the-time-range/m-p/306022#M91864 <P>what is your current syntax?</P> Mon, 22 May 2017 14:41:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-a-chart-with-search-jobs-and-the-time-range/m-p/306022#M91864 cmerriman 2017-05-22T14:41:38Z https://community.splunk.com/t5/Splunk-Search/How-to-display-a-chart-with-search-jobs-and-the-time-range/m-p/306023#M91865 <P>@rvisj... If you have start time and end time (to come up with duration), please check out the <STRONG>Timeline custom visualization</STRONG> : <A href="https://splunkbase.splunk.com/app/3120/">https://splunkbase.splunk.com/app/3120/</A></P> Mon, 22 May 2017 15:14:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-a-chart-with-search-jobs-and-the-time-range/m-p/306023#M91865 niketn 2017-05-22T15:14:22Z https://community.splunk.com/t5/Splunk-Search/How-to-display-a-chart-with-search-jobs-and-the-time-range/m-p/306024#M91866 <P>If it is not necessary, for example because you have already computed the single value you want for each time period, then you can use any of <CODE>min</CODE> or <CODE>max</CODE> or <CODE>avg</CODE> because they will all give the same result.</P> Mon, 22 May 2017 16:42:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-a-chart-with-search-jobs-and-the-time-range/m-p/306024#M91866 DalJeanis 2017-05-22T16:42:41Z https://community.splunk.com/t5/Splunk-Search/How-to-display-a-chart-with-search-jobs-and-the-time-range/m-p/306025#M91867 <P>Use <CODE>first</CODE> as your aggregate function.</P> <P>Or perhaps try the <CODE>contingency</CODE> function, like this:</P> <PRE><CODE>... | contingency Track Time-range </CODE></PRE> Mon, 22 May 2017 18:50:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-a-chart-with-search-jobs-and-the-time-range/m-p/306025#M91867 woodcock 2017-05-22T18:50:26Z https://community.splunk.com/t5/Splunk-Search/How-to-display-a-chart-with-search-jobs-and-the-time-range/m-p/306026#M91868 <P>I have to display time- range, (start-time and end-time) Vs Track. So when using either aggregate function it will return single value, but it should be time range. I am trying using Timeline Visualization.</P> Wed, 24 May 2017 06:06:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-a-chart-with-search-jobs-and-the-time-range/m-p/306026#M91868 rvisj 2017-05-24T06:06:14Z https://community.splunk.com/t5/Splunk-Search/How-to-display-a-chart-with-search-jobs-and-the-time-range/m-p/306027#M91869 <P><A href="https://splunkbase.splunk.com/app/3120/">here</A></P> Wed, 24 May 2017 06:08:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-a-chart-with-search-jobs-and-the-time-range/m-p/306027#M91869 rvisj 2017-05-24T06:08:19Z https://community.splunk.com/t5/Splunk-Search/How-to-display-a-chart-with-search-jobs-and-the-time-range/m-p/306028#M91870 <P>yes I tried, almost got it. one issue remaining is I have to show separate timeline for each event, not overlapped.<BR /> Query:<BR /> /<EM>source</EM>/ | rename "Date Event Began" AS start_date | rename "Date of Restoration" AS end_date | rename "Time Event Began" AS start_time | rename "Time of Restoration" AS end_time | eval _time = strptime(start_date." ".start_time, "%m/%d/%Y %H:%M") | eval end_time = strptime(end_date." ".end_time, "%m/%d/%Y %H:%M") | eval duration = (end_time - _time) * 1000 |stats count by _time, Track, duration, "job" | table _time "Track" "job" duration</P> <P>I want to skip Track and display separate timeline for each job in that track hence avoiding overlap</P> Tue, 29 Sep 2020 14:14:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-a-chart-with-search-jobs-and-the-time-range/m-p/306028#M91870 rvisj 2020-09-29T14:14:20Z https://community.splunk.com/t5/Splunk-Search/How-to-display-a-chart-with-search-jobs-and-the-time-range/m-p/306029#M91871 <P>correction: I want to skip group by track</P> Wed, 24 May 2017 06:45:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-a-chart-with-search-jobs-and-the-time-range/m-p/306029#M91871 rvisj 2017-05-24T06:45:00Z