I'm parsing a log file with the following command:
source="startjob.log" |eval stime=strptime(start_timestamp,"%y/%m/%d.%H:%M:%S") |eval etime=strptime(end_timestamp,"%y/%m/%d.%H:%M:%S") |eval duration= (etime-stime)|timechart avg(duration) by job_name span=1h
which gives me this result set:
"_time",NDM5911D,NTM5443C,NTM5870D,NTM6018D,NTM6225D,NTM6558D,NTM6825D,NTMA12UD,NTU7201D,NTU7370D,OTHER
"2012-08-12T00:00:00.000-0500",,,,,,,,,,,
"2012-08-13T00:00:00.000-0500",,,,,,"11127.000000",,"8541.000000",,,"124.187500"
"2012-08-14T00:00:00.000-0500",,,,,,,,,"16286.000000",,"233.280000"
"2012-08-15T00:00:00.000-0500","15134.000000",,,,,,,,,,"68.000000"
"2012-08-16T00:00:00.000-0500",,"8114.000000","10285.000000","15018.000000","9280.000000",,"9479.000000",,,"12600.000000","277.248609"
"2012-08-17T00:00:00.000-0500",,,,,,,,,,,
"2012-08-18T00:00:00.000-0500",,,,,,,,,,,
"2012-08-19T00:00:00.000-0500",,,,,,,,,,,
Date is the most granular chart it's allowing me, but I'd like to chart what jobs were running by hour and I'd also like to show the duration of the job. For example, I'd like to chart what jobs were running on a week, then drill down to what jobs were running during a certain day, then drill down to what jobs were running in a particular hour and for how long each job ran.
Any ideas?
