I need help making a graphical presentation of the event happening over time. The X-axis will represent the time, and Y-axis will represent the duration of the event. The event will be marked on the graph as dots or little square boxes. Appreciate any help; I have been scratching my head all day for this...
The log lines look something like:
2013-03-06 21:20:03 Starting Job A . . 2013-03-06 21:44:23 Starting Job B . 2013-03-06 21:45:11 Finished Job A . 2013-03-06 21:55:23 Starting Job C . 2013-03-06 22:01:12 Starting Job D . . 2013-03-06 23:11:36 Finished Job B . 2013-03-06 23:25:01 Finished Job D . . 2013-03-07 00:00:56 Finished Job C
I came here with a similar question and as the existing answers didn't help me I kept on looking and found the Timeline - Custom Visualization app ( https://splunkbase.splunk.com/app/3120/ ). I haven't played with it yet but I believe it's exactly what I want to achieve. I also think it's a better solution to your problem as it will make it more obvious if you have overlaps between your jobs and you'll be able to visualise how many jobs were running at any given point.
I think that "transaction" is the command you're looking for:
search your events | transaction job_field | timechart duration