Hi all,
I have data in below that indicates logon and logoff time.
_time | user | startTime | endTime |
20/12/04 18:07:03.000 | A | 1607072823 | 1607073562 |
20/12/04 17:53:22.000 | B | 1607072002 | 1607074229 |
20/12/04 16:21:19.000 | A | 1607066479 | 1607066494 |
20/12/04 16:07:32.000 | C | 1607065652 | 1607065719 |
"_time" is equal to startTime but startTime is epoch time.
I would like to plot this time series data to line chart using timechart command.
Like, x axis indicates time with 1minutes span, and y axis indicates each user name and plot data to be 1 between session startTime and endTime.
index=_internal | head 1 | fields _raw
| eval _raw="_time user startTime endTime
20/12/04 18:07:03.000 A 1607072823 1607073562
20/12/04 17:53:22.000 B 1607072002 1607074229
20/12/04 16:21:19.000 A 1607066479 1607066494
20/12/04 16:07:32.000 C 1607065652 1607065719"
| multikv forceheader=1
| rex "(?<time>\S+ \S+)\s+(?<user>\w)\s+(?<startTime>\d+)\s+(?<endTime>\d+)"
| eval _time=strptime(time,"%y/%m/%d %T.%3Q")
| eval time=mvrange(startTime,endTime,60)
| mvexpand time
| stats count by time user
| rename time as _time
| timechart span=1min cont=f count by user
try column chart with stack
index=_internal | head 1 | fields _raw
| eval _raw="_time user startTime endTime
20/12/04 18:07:03.000 A 1607072823 1607073562
20/12/04 17:53:22.000 B 1607072002 1607074229
20/12/04 16:21:19.000 A 1607066479 1607066494
20/12/04 16:07:32.000 C 1607065652 1607065719"
| multikv forceheader=1
| rex "(?<time>\S+ \S+)\s+(?<user>\w)\s+(?<startTime>\d+)\s+(?<endTime>\d+)"
| eval _time=strptime(time,"%y/%m/%d %T.%3Q")
| eval time=mvrange(startTime,endTime,60)
| mvexpand time
| stats count by time user
| rename time as _time
| timechart span=1min cont=f count by user
try column chart with stack
Thank you!
That's what I wanted to do.
Hi @p2akira,
To do what you like, you should explore the timeline Visualization https://splunkbase.splunk.com/app/3120/
Ciao.
Giuseppe
Hi @gcusello ,
Thank you your app suggestions
I'm aware of that app, but I can't install it because our Splunk is deployed on a closed network or can't bring app packaged file.
Therefore, I would like to implement it by using the line chart that I can use by default.
Thank you.