I have a requirement for having start and stop times with there status be projected over time as a line graph.
I have the query below which provides the desired results but when I go to viz it isn't showing anything since the values projected over Y axis are alphanumeric. Is there a way that I can project this on timeline?
Below is my query and ss for the viz and results.
<base search>
| eval epochtime=_time
| eval desired_time=strftime(epochtime, "%b %d %Y %H:%M:%S.%3N")
| rex "INFO : (?<status>\w+)"
| eval Time_and_status= desired_time + status
| timechart span=20m values(Time_and_status)
| fillnull value=0 values(Time_and_status)
On graph I see a flat line all over.
