Dashboards & Visualizations

Create line chart of search duration in timeline

mngeow
Engager

Hi,

I have some vpn logs which show the vpn login activity per user, primarily the times that they disconnected, the duration of the session and the reason for the disconnection. I want the chart the duration of each session over a month by have a line chart with one line showing each duration, and also for the lines to be colour coded according to the reason of the disconnection.

The graph I am trying to achieve is shown in the link below:

https://wiki.splunk.com/Community:Search_Report:_How_To_Create_a_Line_Chart_of_Search_Duration_in_Ti...

The only difference is that I want the y-axis to be the day of the month, and the x axis to be the hour of the day.

I've tried working on it for several days and this is my current query:

earliest=-30d index=xxx sourcetype=xx Username=xx
| table reason _time duration
| eval startime=_time - duration
| eval BeginSession=strftime(startime,"%Y-%m-%d %H:%M:%S")
| eval EndSession=strftime(_time,"%Y-%m-%d %H:%M:%S")
| table reason *Session
| eval combinedt=BeginSession.",",EndSession
| makemv delim="," combinedt
| mvexpand combinedt
| eval _time=combinedt
| rename combinedt as Time

This gives me a time series of consecutive connection and disconnection timings, but I am pretty much stuck at this point. Any help would be greatly appreciated.

Thanks!

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Give this a try

earliest=-30d index=xxx sourcetype=xx Username=xx
 | table reason _time duration
 | eval startime=_time - duration
 | table reason *Session
 | eval combinedt=startime.","._time
 | makemv delim="," combinedt
 | mvexpand combinedt
 | eval _time=combinedt
 | timechart useother=f span=1s first(duration) by reason
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...