Dashboards & Visualizations

How to dispaly chart with start time ,duration by application



I wanted to show the Application running on line chart. Process start_time is _time and have duration and application .
Wanted to show the chart by application which starts at _time and comes down after the given duration.

For example, below is two events:
_time host duration Application
2020-04-21 16:51:29 ABC 01:43 XXXX

2020-04-21 16:46:29 ABC 03:56 XXXX

2020-04-21 16:56:29 ABC 06:43 YYYY

so, first event it should show the line goes up at 2020-04-21 16:51:29 and after 1:43 duration line goes down.

Is this possible? Please suggest.

Tags (1)
0 Karma

Ultra Champion
| makeresults
| eval _raw="_time,host,duration,Application
2020-04-21 16:51:29,ABC,01:43,XXXX
2020-04-21 16:46:29,ABC,03:56,XXXX
2020-04-21 16:56:29,ABC,06:43,YYYY"
| multikv forceheader=1
| table time,host,duration,Application
| eval duration2=tonumber(mvindex(split(duration,":"),0))*60+tonumber(mvindex(split(duration,":"),1))
| eval _time=strptime(time,"%F %T")
| eval time2=_time+duration2
| eval time=mvappend(_time,time2)
| streamstats count as session
| mvexpand time
| eval _time=time
| reverse
| streamstats current=f count as check by session
| reverse
| eval check=check*10
| table _time Application check
| xyseries _time Application check

Line Chart
maybe, you can do it.

0 Karma


@to4kawa thank you for your reply.
Is it possible to show in line chart like for example at 4:46 PM line goes up (vertically) and it will horizontal till duration (3:56) and then at that point its comes down. ??

if possible , then please suggest how to achieve it.

0 Karma

Ultra Champion

How about Area Chart?

0 Karma


@to4kawa yes, we can show. Any sample query please to show area covered on that duration?

0 Karma

Ultra Champion
  1. make time3like same making time2 and mvappend
  2. modify check calculation with case()

you need three values by each Application

you can do it

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

Happy CX Day, Splunk Community!

Happy CX Day, Splunk Community! CX stands for Customer Experience, and today, October 3rd, is CX Day — a ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...