How to display time ranges based on chart/table data

[chadman]

I have a timechart that works ok, but can be hard to read because of how Splunk averages the data. I have tried to show the chart as values and that also works, but still is hard to read. My goal is so have a nice way to preset some time ranges to the user. The data is either true/false and gets reported every min. I would like to display to the users all the time ranges the data is true in the search. Below is the chart I tried, but I'm not sure a chart is the best way to display this.

sourcetype="data1" host=host1
        | eval "Workstation Locked" = if(lock="True",1,0) 
        | chart values("Workstation Locked") as "Workstation Locked" by date

[sundareshr · Accepted solution]

Have you look at the timeline app?

https://splunkbase.splunk.com/app/3120/

[chadman]

that does look cool, but I prefer a search option that does not require an addon if that's possible. It does not have to be in a chart.

[sundareshr]

Try this then

sourcetype="data1" host=host1
| autoregress lock
| streamstats count(eval(lock!=lock_p1)) as group 
| stats earliest(_time) as start latest(_time) as end by host group
| eval start=strftime(start, "%c")
| eval end=strftime(end, "%c")

[chadman]

Looks good! I forgot to mention in my post that I would only like to see the time ranges when lock=1. I tired to add a | where lock=1 in the beginning of the search, but that broke it.

[sundareshr]

Add the where after just before the stats. Like this

 sourcetype="data1" host=host1
 | autoregress lock
 | streamstats count(eval(lock!=lock_p1)) as group 
 | where lock=1
 | stats earliest(_time) as start latest(_time) as end by host group
 | eval start=strftime(start, "%c")
 | eval end=strftime(end, "%c")

[chadman]

Thanks! I figured it out just before your post. Thanks again for another great solution!