Dashboards & Visualizations

How to get timechart to display duration of event?


Is it possible to use timechart, or another command, to display the results over a time series but instead of the single data point of when the event occurred, it can expand the width of the event to cover the time span?

I was going to show this in an enhanced timeline but I'm displaying events over 60 days and ones that has a duration of a day or two are hard to see.

I used rex and eval to extract date time fields for the "Start" and "End" of the event

Labels (2)
0 Karma


Hi @michaeler,

it isn't so easy, but if you install the timeline app (https://splunkbase.splunk.com/app/3120) and you follow the instructions and samples, you can have what you're serching.



0 Karma
Get Updates on the Splunk Community!

Infographic provides the TL;DR for the 2023 Splunk Career Impact Report

We’ve been shouting it from the rooftops! The findings from the 2023 Splunk Career Impact Report showing that ...

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...