Splunk Search

How To Create a Date Chart Per Source?

vtsguerrero
Contributor

I have a dynamic field that is the length of an event, it's currently generated by the eval length = (end_time - start_time).

The problem is, that it's almost like a timechart, but not a timechart.
It should show in the Y-Axis, Splunk Time Progression, and in the X-Axis, Name Of Each Source (event).
Inside the graph, events should be placed with the length created by these events.
Here is my current search:

index=full sourcetype=temp DATA_INICIO=* DATA_FIM=* PROCESS_NAME=*
| eval LENGTH = (START_DATE - END_DATE) 
| eval LENGTH = strptime( LENGTH, "%d/%m/%Y-%T")   
| stats first(LENGTH) by source

This graphic would demonstrate length of these events only by hour-minute-second, date is not required.
I was using chart or timechart, but it was actually counting the events, and not only displaying them.
Can anyone help me with this similar like timechart?
Thanks in advance!

0 Karma

Richfez
SplunkTrust
SplunkTrust

Have you looked at the Gantt chart app?
https://apps.splunk.com/app/1741/
It might give you the chart you want.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...