Hi allknowing Splunkbase!
I have events that have the value x_duration and start time - With this value we can calculate the stop time, - but how do i plot this in a timechart to show when users where active based on the start and stop time?
Fields i have are :
Starttime = this is when the event start (hh.mm.ss)
x_duration = this is the number of seconds the event should show in the timechart
Stoptime = this is when the event should stop (hh.mm.ss)
So i need the event to increase by 1 in the timechart during the interval of starttime < AND > stoptime per event.
I am uncertain how to attack this problem. Any ideas?
I've done something similar before using a combination of
accum. But, I had distinct start and stop events. It worked something like this:
blah blah blah | eval count_start=if(is_start_event==1,1,0) | eval count_end=if(is_end_event==1,1,0) | accum count_start AS total_started | accum count_end AS total_ended | eval activecount= total_ended - total_started
It's not always 100% mathematically accurate, especially if the start event is outside of the search time range but the end event is not. But, for my purpose it was a good enough approximation.
concurrency search command may get very close to what you're trying to do. Have you looked at it?
concurrency search command does exactly what you are looking for with a start time and a duration.
gkanapathy and dwaddle takes the price!! Thats the command i was looking for!! Excellent 🙂
It now shows the number of concurrent users based on the duration field! Thank you!