Dashboards & Visualizations

How to draw cumulative timechart using a csv file?

vcanal
Explorer

Hello,

I'm trying to draw a cumulative timechart using a csv file which contains events, each event with its starting date and its ending date (basically three fields : "EventName", "StartingDate" and "EndingDate"). The line in the chart should increase when an event starts and decrease when an event finishes. I attached an example of what I am trying to explain, hope it helps.

I tried to create time ranges with the starting and ending date to draw the chart I want, but I'm not sure it's the correct way to do it...

Thanks in advance

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

No, I missed the days in the multiplication - having said that, use relative_time() instead as it copes with DST changes better - also set the span for timechart so it doesn't default to something else

| eval days=mvrange(0, floor((EndingDate - StartingDate) / (60*60*24)))
| mvexpand days
| eval StartingDate = relative_time(StartingDate,"+".days."d")
| eval _time = StartingDate
| timechart span=1d count

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| eval days=mvrange(0, floor((EndingDate - StartingDate) / (60*60*24)))
| mvexpand days
| eval StartingDate = StartingDate + (60*60*24)
| eval _time = StartingDate
| timechart count

vcanal
Explorer

Thank you for your quick response ! 

I tried your solution (the csv test file and the result are attached), but the line doesn't remain constant like I would like. 

Did I miss something ?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

No, I missed the days in the multiplication - having said that, use relative_time() instead as it copes with DST changes better - also set the span for timechart so it doesn't default to something else

| eval days=mvrange(0, floor((EndingDate - StartingDate) / (60*60*24)))
| mvexpand days
| eval StartingDate = relative_time(StartingDate,"+".days."d")
| eval _time = StartingDate
| timechart span=1d count

vcanal
Explorer

Thanks a lot, it's exactly what I was looking for!

0 Karma
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...