Splunk Search

Chart logon session duration:hour of day as x axis and day of the month as y axis, duration of session as a line segment

mngeow
Engager

Hi,

I have a couple of logs showing user login and logout sessions. I'm trying to display each session of a specific user as in the picture shown below:

Graph

The X-axis represents the hour of the day, and the Y-axis represents the day on the month. Each line segment should represent an individual session and the duration should correspond to it's length. Each segment should also be color coded according to the reason for the logout, be it idle timeout for user requested logout.

I have already calculated the following fields:

  1. Login Time
  2. Logout Time
  3. Logout Reason
  4. Session Duration

I managed to get a scatter plot working with the following segment of code:

  index=** source=** sourcetype=** User=**
    | eval endhour=( (date_hour*3600)+(date_minute*60)+date_second)
    | eval starthour=endhour-duration
    | eval hour=starthour.",".endhour
    | makemv delim="," hour
    | mvexpand hour
    | table reason hour date_mday
    | streamstats count
    | eval Mod= count % 2
    | eval Status= if(Mod==0,"Connected Started",reason)
    | table Status hour date_mday
    | eval hour=hour/3600

The code takes each disconnection reason, and the starting of each connection as an event, and just plots the point on the scatterplot. As shown:

Scatterplot

However, what I ultimately want to achieve is a graph that looks like the first picture, but I've been unable to get it to do so. I've tried charting my data using xyseries and timechart but I just can't get it to work.

Help would be greatly appreciated! Thanks!

Labels (1)
0 Karma

kevinb0011
Explorer

Curious did you find a solution for this? Trying to do the same thing

0 Karma

niketn
Legend

@mngeow based on the details and mock screenshot provided, you should look into following two custom visualizations:

1) Timeline Custom Visualization
2) Punchcard Custom Visualization

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...