Dashboards & Visualizations

How to create a dashboard with a bar between two fields



I want to create a dashboard, similar to a gantt chart that has a bar between two fields derived by _time, LDAP sync start and LDAP sync end. I'm unsure on how to achieve this. There will be multiple instances of the two fields and I'd like to know how to group them together as well.

Here's my base search, currently only looks for latest:

index=index_name act="LDAP Synchronization start" OR act="LDAP Synchronization end"
| stats max(eval(if(act="LDAP Synchronization start", _time, 0))) as start max(eval(if(act="LDAP Synchronization end", _time, 0))) as end
| eval "LDAP Sync Start"=strftime(start,"%d/%m/%Y %H:%M:%S"), "LDAP Sync End"=strftime(end,"%d/%m/%Y %H:%M:%S")

Labels (2)
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.