Splunk Search

How To Create a Date Chart Per Source?


I have a dynamic field that is the length of an event, it's currently generated by the eval length = (end_time - start_time).

The problem is, that it's almost like a timechart, but not a timechart.
It should show in the Y-Axis, Splunk Time Progression, and in the X-Axis, Name Of Each Source (event).
Inside the graph, events should be placed with the length created by these events.
Here is my current search:

index=full sourcetype=temp DATA_INICIO=* DATA_FIM=* PROCESS_NAME=*
| eval LENGTH = strptime( LENGTH, "%d/%m/%Y-%T")   
| stats first(LENGTH) by source

This graphic would demonstrate length of these events only by hour-minute-second, date is not required.
I was using chart or timechart, but it was actually counting the events, and not only displaying them.
Can anyone help me with this similar like timechart?
Thanks in advance!

0 Karma


Have you looked at the Gantt chart app?
It might give you the chart you want.

0 Karma