I wanted to show the Application running on line chart. Process start_time is _time and have duration and application .
Wanted to show the chart by application which starts at _time and comes down after the given duration.
For example, below is two events:
_time host duration Application
2020-04-21 16:51:29 ABC 01:43 XXXX
2020-04-21 16:46:29 ABC 03:56 XXXX
2020-04-21 16:56:29 ABC 06:43 YYYY
so, first event it should show the line goes up at 2020-04-21 16:51:29 and after 1:43 duration line goes down.
Is this possible? Please suggest.
| makeresults | eval _raw="_time,host,duration,Application 2020-04-21 16:51:29,ABC,01:43,XXXX 2020-04-21 16:46:29,ABC,03:56,XXXX 2020-04-21 16:56:29,ABC,06:43,YYYY" | multikv forceheader=1 | table time,host,duration,Application | eval duration2=tonumber(mvindex(split(duration,":"),0))*60+tonumber(mvindex(split(duration,":"),1)) | eval _time=strptime(time,"%F %T") | eval time2=_time+duration2 | eval time=mvappend(_time,time2) | streamstats count as session | mvexpand time | eval _time=time | reverse | streamstats current=f count as check by session | reverse | eval check=check*10 | table _time Application check | xyseries _time Application check
maybe, you can do it.
@to4kawa thank you for your reply.
Is it possible to show in line chart like for example at 4:46 PM line goes up (vertically) and it will horizontal till duration (3:56) and then at that point its comes down. ??
if possible , then please suggest how to achieve it.