All Apps and Add-ons

Vizualizing Application Start End Times

vivasaayi
Engager

I am monitoring 4 applications. Each application is assigned an unique name (like App1, App2) and each running instance will have an instance id (a distinct GUID - SVID) and I am logging when they are started and stopped. I am able to get the duration, start time and end times of applications using the following query.

  • | where like (MESSAGE, "%Started%") or like (MESSAGE, "%Disposed%") | transaction SVID | eval starttime=strftime(_time, "%D %H:%M:%S") | eval endtime= strftime(_time+duration, "%D %H:%M:%S") | table SVID starttime duration endtime

The table looks fine.

    APP     SVID                                    Start Time          Duration    End Time
1   App1    3f3c74bf-375b-4442-bd38-b6a22092a2c2    10/04/13 12:26:11   2.646   10/04/13 12:26:13
2   App1    0705742b-4d45-4203-8229-4f1571952a49    10/04/13 12:25:24   13.066  10/04/13 12:25:38
3   App2    5ae6483e-7e24-4f0b-93f1-7c1c0bd94c49    10/04/13 10:54:25   0       10/04/13 10:54:25

I am tying to create a Chart, which shows the start and end times as follows.

|
|       ****************************************    **********          ***************
|
|       ======= ====    ====    =====   =============================== =======
|
|       ++++++++        ++++++++++++++++++++++++++              ++++    +++++++++   ++++++
|
|
|_______________________________________________________________________________________________
                            Time

* - App1
= - App2
+ - App3

Could you please help?

yoho
Contributor

Hello, I have not yet found time to create this chart (low priority here) but I found this viz app which could reveal quite useful to create such a dashboard: https://splunkbase.splunk.com/app/1741/

0 Karma

duraij
Explorer

Were you able to achieve this I am trying to do the same thing.Please let me know

0 Karma

yoho
Contributor

Me too. I think it's not very trivial given the visualization tools of splunk. In the end, it comes down to making the timechart of a field whose value is 1 when your process is up and 0 when it's down. I'm also trying to make a chart similar to this one (well, less elaborate): http://www.bootchart.org/images/bootchart.png

0 Karma

adrianfowler
New Member

Did you have success with this? As I am trying to do the same thing!

0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...