I have a dynamic field that is the length of an event, it's currently generated by the eval length = (end_time - start_time).
The problem is, that it's almost like a timechart, but not a timechart.
It should show in the Y-Axis, Splunk Time Progression, and in the X-Axis, Name Of Each Source (event).
Inside the graph, events should be placed with the length created by these events.
Here is my current search:
index=full sourcetype=temp DATA_INICIO=* DATA_FIM=* PROCESS_NAME=*
| eval LENGTH = (START_DATE - END_DATE)
| eval LENGTH = strptime( LENGTH, "%d/%m/%Y-%T")
| stats first(LENGTH) by source
This graphic would demonstrate length of these events only by hour-minute-second, date is not required.
I was using chart or timechart, but it was actually counting the events, and not only displaying them.
Can anyone help me with this similar like timechart?
Thanks in advance!
