How to write a search to graph the duration scripts ran using "begin" and "finished" time fields?

[alanxu]

Right now I have two different scripts: report scripts and procedure scripts. They have a begin and finished time. I am trying to create a graph using the time as the y-axis and the report as the x-axis and the procedure as x-axis on another graph. Example text would be...

2012-03-22 00:7:02,318 INFORMATION Begin Procedure Script
2012-03-22 00:8:02,318 INFORMATION FINISHED Procedure Script (0)

[woodcock · Accepted solution]

Your question is too vague but this should get you started:

... | rex "^\W+\w+\W+\w+(?<Report>\W+)\w+(?<BeginOrFinished>\W+)\w+(?<Procedure>.*)$" | where BeginOrFinished="Begin" | timechart ...

[alanxu]

Is there anything I clarify? But thank you for answering.. I will check what those commands do.

[woodcock]

What exactly are you trying to chart? I can guess but that is silly! Just for grins, here are a few guesses with answers:

To chart the number of jobs completed per Report per hour, do this:

 ... | rex "^\W+\w+\W+\w+(?<Report>\W+)\w+(?<BeginOrFinished>\W+)\w+(?<Procedure>.*)$" | timechart span=1h count(eval(BeginOrFinished="FINISHED")) AS CompletedJobCount by Report

To chart the number of jobs initiated per Procedure per minute, do this:

 ... | rex "^\W+\w+\W+\w+(?<Report>\W+)\w+(?<BeginOrFinished>\W+)\w+(?<Procedure>.*)$" | timechart span=1m count(eval(BeginOrFinished="Begin")) AS InitiatededJobCount by Procedure

[woodcock]

I fixed a minor error (re-edited).