How to create user logon session line chart by timechart command

[p2akira]

Hi all, 

I have data in below that indicates logon and logoff time.

_time	user	startTime	endTime
20/12/04 18:07:03.000	A	1607072823	1607073562
20/12/04 17:53:22.000	B	1607072002	1607074229
20/12/04 16:21:19.000	A	1607066479	1607066494
20/12/04 16:07:32.000	C	1607065652	1607065719

"_time" is equal to startTime but startTime is epoch time.

I would like to plot this time series data to line chart using timechart command.

Like, x axis indicates time with 1minutes span, and y axis indicates each user name and plot data to be 1 between session startTime and endTime.

[to4kawa · Accepted solution]

index=_internal | head 1 | fields _raw 
| eval _raw="_time	user	startTime	endTime
20/12/04 18:07:03.000	A	1607072823	1607073562
20/12/04 17:53:22.000	B	1607072002	1607074229
20/12/04 16:21:19.000	A	1607066479	1607066494
20/12/04 16:07:32.000	C	1607065652	1607065719"
| multikv forceheader=1
| rex "(?<time>\S+ \S+)\s+(?<user>\w)\s+(?<startTime>\d+)\s+(?<endTime>\d+)"
| eval _time=strptime(time,"%y/%m/%d %T.%3Q")

| eval time=mvrange(startTime,endTime,60)
| mvexpand time
| stats count by time user
| rename time as _time
| timechart span=1min cont=f count by user

try column chart with stack

[p2akira]

Thank you!

That's what I wanted to do.

[gcusello]

Hi @p2akira,

To do what you like, you should explore the timeline Visualization https://splunkbase.splunk.com/app/3120/

Ciao.

Giuseppe

[p2akira]

Hi @gcusello ,

Thank you your app suggestions

I'm aware of that app, but I can't install it because our Splunk is deployed on a closed network or can't bring app packaged file.
Therefore, I would like to implement it by using the line chart that I can use by default.

Thank you.