I have some jobs, which have some time frame to run. Every job belongs to some track.
My purpose is to plot Track vs Time-range chart for those jobs.
I tried using chart and timechart but they have to have some aggregate function on on axis. In this case it is not necessary.
Any tips will be helpful!!
If it is not necessary, for example because you have already computed the single value you want for each time period, then you can use any of
avg because they will all give the same result.
I have to display time- range, (start-time and end-time) Vs Track. So when using either aggregate function it will return single value, but it should be time range. I am trying using Timeline Visualization.
@rvisj... If you have start time and end time (to come up with duration), please check out the Timeline custom visualization : https://splunkbase.splunk.com/app/3120/
yes I tried, almost got it. one issue remaining is I have to show separate timeline for each event, not overlapped.
/source/ | rename "Date Event Began" AS start_date | rename "Date of Restoration" AS end_date | rename "Time Event Began" AS start_time | rename "Time of Restoration" AS end_time | eval _time = strptime(start_date." ".start_time, "%m/%d/%Y %H:%M") | eval end_time = strptime(end_date." ".end_time, "%m/%d/%Y %H:%M") | eval duration = (end_time - _time) * 1000 |stats count by _time, Track, duration, "job" | table _time "Track" "job" duration
I want to skip Track and display separate timeline for each job in that track hence avoiding overlap