Splunk Search

Create a graph with time fields different than event's timestamp

edrivera3
Builder

Hi
In my events I have the following fields:
1. Initial_time (This is different than event's timestamp) (format=string)
2. End_time (This is different than event's timestamp) (format=string)
3. Process Name (format=string)

I am interested to create a graph which has time in x-axis and process names in y-axis. I want to show the multiple processes and duration time of each of them in the graph. I am not sure if this possible.

I already strptime() both time fields so now I can manipulate them.

If this is not possible. Is there a way to get something similar with a different graph. I want to see the duration of each of the process simultaneously and see if they overlap during some period of time.

0 Karma

stephane_cyrill
Builder

try this:
..........|stats .......................over yourField

0 Karma

edrivera3
Builder

I do not understand your answer. Could you explain how your answer could help me?

0 Karma

edrivera3
Builder

This is what I have already:
(Both time fields are multivalue fields so I am only interested in the minimum value of ini_time and maximum value of end_time.)

...| eval ini_stamp=strptime(ini_time,"%b %d %H:%M:%S %Y") | eval end_stamp=strptime(end_time,"%b %d %H:%M:%S %Y") | stats max(end_stamp) AS high min(ini_stamp) AS low by process_name| eval duration = high - low

So basically I also have the duration time of process_name

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...