All Apps and Add-ons

Timeline - Custom Visualization: How do create a timeline based on this log's time format?

Toshbar
Explorer

I have a log that contains two distinct entries per JOBID. For example:

DATETIME:    2017-07-20 03:00:07.51 -0700       
JOBID:   123
MSGTXT:  123 - STARTED - TIME=03.00.07  

and

DATETIME:    2017-07-20 03:00:15.12 -0700   
JOBID:   123
MSGTXT:  123 - ENDED - TIME=03.00.15    

My search to find these two logs is:

index = x  JOBID = "123" MSGTXT = "\*started - time\*" OR "\*ended - time\*"
| stats values(DATETIME) by JOBID

I'm trying to create a custom timeline visualization to show the range of start time to end time by JOBID but I'm getting the following error: "Error rendering Timeline visualization: Invalid time format specified: CIBI8961. Supported time formats are RFC2822, ISO 8601, and epoch time"

I want the x axis to show a time range of 0-24 hours so I'm not sure if converting to epoch time would display in the way I'd like it to. Any help/idea/tips? Thank you.

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

index = x  JOBID = "123" MSGTXT = "\*started - time\*" OR "\*ended - time\*"
| stats range(_time) AS duration BY JOBID

Or, if _time is bad (you REALLY should fix that), like this:

index = x  JOBID = "123" MSGTXT = "\*started - time\*" OR "\*ended - time\*"
| rex "DATETIME:\s+(?<time>[^\r\n]+)"
| eval time=strptime(time, "%Y-%m-%d %H:%M:%S %Z)"
| stats range(time) AS duration BY JOBID

View solution in original post

woodcock
Esteemed Legend

Like this:

index = x  JOBID = "123" MSGTXT = "\*started - time\*" OR "\*ended - time\*"
| stats range(_time) AS duration BY JOBID

Or, if _time is bad (you REALLY should fix that), like this:

index = x  JOBID = "123" MSGTXT = "\*started - time\*" OR "\*ended - time\*"
| rex "DATETIME:\s+(?<time>[^\r\n]+)"
| eval time=strptime(time, "%Y-%m-%d %H:%M:%S %Z)"
| stats range(time) AS duration BY JOBID
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...