Splunk Search

How To Create a Date Chart Per Source?

vtsguerrero
Contributor

I have a dynamic field that is the length of an event, it's currently generated by the eval length = (end_time - start_time).

The problem is, that it's almost like a timechart, but not a timechart.
It should show in the Y-Axis, Splunk Time Progression, and in the X-Axis, Name Of Each Source (event).
Inside the graph, events should be placed with the length created by these events.
Here is my current search:

index=full sourcetype=temp DATA_INICIO=* DATA_FIM=* PROCESS_NAME=*
| eval LENGTH = (START_DATE - END_DATE) 
| eval LENGTH = strptime( LENGTH, "%d/%m/%Y-%T")   
| stats first(LENGTH) by source

This graphic would demonstrate length of these events only by hour-minute-second, date is not required.
I was using chart or timechart, but it was actually counting the events, and not only displaying them.
Can anyone help me with this similar like timechart?
Thanks in advance!

0 Karma

Richfez
SplunkTrust
SplunkTrust

Have you looked at the Gantt chart app?
https://apps.splunk.com/app/1741/
It might give you the chart you want.

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...