I would like to make a bar chart, where date/time is on the X-axis, and the resource is the Y-axis, the bar should start at _time, and have a length of duration.
Is this possible using only base Splunk 6.1, or is it necessary to download and install additional apps?
If it is possible what would the chart look like?
Thanks in advance.
take this run everywhere example:
index=_internal | chart values(kb) over series by _time
this will generate a bar graph like this:
hope this helps ...
Yes, but all the bars start at zero, what I would like was for the individual bar to start at the time indicated by _time in the event, and have the length indicated by duration, and then have the X-axis as _time.
Yes, that is something in the line I was looking for.
It took some time, but I got the gist, and found a solution, that works for me based on the example.
The trick is to have a start and end event, with a unique number, and then do a line graf on that number. That will produce a nice horisontal line, spanning from start to end.
The search is as follows:
eventtype=TWSlogs eventtype=TWSjobevents NOT (userID = "TWSD01" OR userID = "TWSP01") submitName=* NOT submitName=TWSON* (eventText="TWSJobAbend" OR eventText="TWSJobFailed" OR eventText="TWSJobLaunched" OR eventText="TWSJob_Done") | dedup _raw | eval label=submitName."-".jobNumber | timechart limit=0 first(jobNumber) by label
And what I end up with, is a result set like this:
Where the four arrows indicate the unique number, and a name wich is concatenated as a label
The end result is as follows:
The graph is rather large, so I have just taken a small portion.