Splunk Search

Event Timechart with event duration

lain179
Communicator

Hello,

I need help making a graphical presentation of the event happening over time. The X-axis will represent the time, and Y-axis will represent the duration of the event. The event will be marked on the graph as dots or little square boxes. Appreciate any help; I have been scratching my head all day for this...

The log lines look something like:

2013-03-06 21:20:03    Starting Job A
.
.
2013-03-06 21:44:23    Starting Job B
.
2013-03-06 21:45:11    Finished Job A
.
2013-03-06 21:55:23    Starting Job C
.
2013-03-06 22:01:12    Starting Job D
.
.
2013-03-06 23:11:36    Finished Job B
.
2013-03-06 23:25:01    Finished Job D
.
.
2013-03-07 00:00:56    Finished Job C
Tags (2)
0 Karma
1 Solution

lain179
Communicator

I found the solution myself.

do your seach | transaction JobName | chart values(duration) over _time by JobName

View solution in original post

gabriel_vasseur
Contributor

I came here with a similar question and as the existing answers didn't help me I kept on looking and found the Timeline - Custom Visualization app ( https://splunkbase.splunk.com/app/3120/ ). I haven't played with it yet but I believe it's exactly what I want to achieve. I also think it's a better solution to your problem as it will make it more obvious if you have overlaps between your jobs and you'll be able to visualise how many jobs were running at any given point.

0 Karma

lain179
Communicator

I found the solution myself.

do your seach | transaction JobName | chart values(duration) over _time by JobName

giorgio_adami_m
Path Finder

I think that "transaction" is the command you're looking for:

http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Transaction

For example:

search your events | transaction job_field | timechart duration

lain179
Communicator

That will not give you an idea of which jobs happened when.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

What do you want to see in your graphical presentation?

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...