Splunk Search

Can you help me show the status duration, timechart with stack bars in 30min spans?

proyleJDS
Path Finder

This could get a little tedious but here goes:

I have call centre data that is giving me the users' statuses, whether they are in a call — or another status, like in coaching or on a break.

I have the start time of the status change and the event time stamp from which I can calculate the duration of the status to determine how long the user was on a call or in a meeting etc.

Here is a typical timeline for a user status over say 2 hours

in a call - 40min
after call work - 10min
in a call - 20min
after call work - 10min
coaching - 20min
break - 20min

Each status that runs longer than a minute will have multiple events. Each one having a timestamp further from the StatusStarttime, so the duration increases until the events finish for that status, this latest event is the event that I grab and plot on a timeline.

it might look a bit like this:

alt text

The client would like to see a 100% stacked bar in 30 min increments. As you can see from the chart, there are many events that have durations that cross the 30 min boundaries so the stacked bars rarely add up.

Is there a way to split the events (like the one with the red arrow) with overlapping durations and divide them correctly into the different 30 min time slots?

I told you it was tedious.

1 Solution

chrisyounger
SplunkTrust
SplunkTrust

If you have data that logs state change type events you can use logic like this:

Firstly do this to show what the user was doing when we know they changed status:
| timechart span=1m latest(status) as status by employee

Then carry-over the state until they change state again:
|filldown

Then do another timechart with the span you actually care about:
| timechart span=1h count by status

All the best

View solution in original post

chrisyounger
SplunkTrust
SplunkTrust

If you have data that logs state change type events you can use logic like this:

Firstly do this to show what the user was doing when we know they changed status:
| timechart span=1m latest(status) as status by employee

Then carry-over the state until they change state again:
|filldown

Then do another timechart with the span you actually care about:
| timechart span=1h count by status

All the best

cmerriman
Super Champion

Do you have any data you can provide for us to play with? stripped of any PII?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...