graphing mainteance windows

[yongly]

Hi all,

So I'm trying to make a graph some information about maintenance windows and I have a log with information about:

xxxx starting

xxxx ending

xxx starting

abc starting

dcf starting

abc ending

etcetc

What I'd like to do is to be able to have a graph of (cumulative total of starting)-(cumulative total of ending)

I figure that value will give me the number of active maintenace windows at any one point in time.

Anyone can point a splunk newbie in the right direction?

[Ayn · Accepted solution]

This question is related to keeping track of states. I always think of this excellent blog post on that subject: http://blogs.splunk.com/2011/01/11/maintaining-state-of-the-union/