Splunk Search
Highlighted

How can I create a chart with the range start and end date in the y-axis?

New Member

Example data :

startdate enddate batch_name
2017-11-18 12:12:13 2017-11-18 15:12:13 job1
2017-11-18 10:12:13 2017-11-18 12:12:13 job2

I have to create a chart where the x-axis contains the timechart span=1d by batchnm and y axis should display the range startdate and end_date data so that we can see when the job1 started and job1 ended.

0 Karma
Highlighted

Re: How can I create a chart with the range start and end date in the y-axis?

SplunkTrust
SplunkTrust

If you need that, here's one easy way:

1) Convert the start time to decimal hours after midnight.
2) Calculate the duration of the job in decimal hours.
3) Present the results as a stacked bar chart with the start time on the bottom and the duration on top.

0 Karma
Highlighted

Re: How can I create a chart with the range start and end date in the y-axis?

Esteemed Legend

Like this:

| makeresults 
| eval raw="2017-11-18 12:12:13 2017-11-18 15:12:13 job1::2017-11-18 10:12:13 2017-11-18 12:12:13 job2"
| makemv delim="::" raw
| mvexpand raw
| rename raw AS _raw
| rex "^(?<start_date>\S+\s+\S+)\s+(?<end_date>\S+\s+\S+)\s+(?<job_id>\S+)$"
| fields - _raw

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| eval start_date = strptime(start_date, "%Y-%m-%d %H:%M:%S")
| eval end_date = strptime(end_date, "%Y-%m-%d %H:%M:%S")
| eval _time = start_date
| fieldformat start_date=strftime(start_date, "%Y-%m-%d %H:%M:%S")
| fieldformat end_date=strftime(end_date, "%Y-%m-%d %H:%M:%S")
| eval duration = end_date - start_date
| rename COMMENT AS "to convert to minutes, add '| eval duration=duration/60'"
| rename COMMENT AS "to convert to hours, add '| eval duration=duration/(60*60)'"
| timechart avg(duration) AS duration BY job_id
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.