Splunk Search

How can I create a chart with the range start and end date in the y-axis?

venkatsivab
New Member

Example data :

start_date end_date batch_name
2017-11-18 12:12:13 2017-11-18 15:12:13 job1
2017-11-18 10:12:13 2017-11-18 12:12:13 job2

I have to create a chart where the x-axis contains the timechart span=1d by batch_nm and y axis should display the range start_date and end_date data so that we can see when the job1 started and job1 ended.

0 Karma

woodcock
Esteemed Legend

Like this:

| makeresults 
| eval raw="2017-11-18 12:12:13 2017-11-18 15:12:13 job1::2017-11-18 10:12:13 2017-11-18 12:12:13 job2"
| makemv delim="::" raw
| mvexpand raw
| rename raw AS _raw
| rex "^(?<start_date>\S+\s+\S+)\s+(?<end_date>\S+\s+\S+)\s+(?<job_id>\S+)$"
| fields - _raw

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| eval start_date = strptime(start_date, "%Y-%m-%d %H:%M:%S")
| eval end_date = strptime(end_date, "%Y-%m-%d %H:%M:%S")
| eval _time = start_date
| fieldformat start_date=strftime(start_date, "%Y-%m-%d %H:%M:%S")
| fieldformat end_date=strftime(end_date, "%Y-%m-%d %H:%M:%S")
| eval duration = end_date - start_date
| rename COMMENT AS "to convert to minutes, add '| eval duration=duration/60'"
| rename COMMENT AS "to convert to hours, add '| eval duration=duration/(60*60)'"
| timechart avg(duration) AS duration BY job_id
0 Karma

DalJeanis
Legend

If you need that, here's one easy way:

1) Convert the start time to decimal hours after midnight.
2) Calculate the duration of the job in decimal hours.
3) Present the results as a stacked bar chart with the start time on the bottom and the duration on top.

0 Karma

shugup2923
Path Finder

How can we Present the results as a stacked bar chart with the start time on the bottom and the duration on top.
can you please help ?

0 Karma
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...