Here is my query
| search "Some operation:*"
| rex field=message "Some operation: (?<operation>\w+), .* for correlationId: (?<correlationid>.*)"
| reverse
| stats first(_time) as Start, last(_time) as End by correlationid, operation
| eval time=_time
| eval duration=End-Start
I am getting table of data like
correlationid, operation, start, end, duration
| 09360e85-c4af-4e1e-896a-be626c1a9cdd | DRAFT | 1619423349.842 | 1619423350.010 | 0.168 |
| 0957aa55-7c43-4a74-b50b-2b7f904cdf15 | QUEUE_FOR_SUBMISSION | 1619427837.169 | 1619427837.271 | 0.102 |
I want to show a bar chart with time (start time) in x-axis, and a bar for each operation duration.
How can I do that ?
