Line Chart Time Between Two Searched Fields

[chrisboy68]

Hi, This should be easy, but I'm getting confused making it work. I have the following:

Time: 01:00 PM Event: STARTED
Time: 01:35 PM Event: STOPPED
TIme: 04:00 PM Event: STARTED
Time: 04:30 PM Event: STOPPED

Given I have two fields, Time and Event. I want a solid line chart showing the range of time an Event STARTED and an Event STOPPED.

Any pointers?

Thank you,

Chris

[andrey2007]

Try to use transaction something like this ...
...| eval newfield="newfield"| transaction newfield startswith="STARTED" endswith="stoped" | table duration
it will give you autogenerated duration field (range between stopped and started)

oh, I was late with answer publication for 1 minute

[chrisboy68]

Thank you very much for the response. I'm going to dig into both suggestions!

Chris

[lguinn2]

It's actually not that easy for Splunk. A timechart has a continuous timeline across the x-axis. But what Splunk sees with these 4 events is simply 4 points in time, with nothing in between. So you could do a chart, but how would Splunk know to fill in at 1:01 but not at 1:40? Also, you really need an event identifier - what if events overlap?

So try this

yoursearchhere
| eval TT=_time 
| transaction startswith="STARTED" endswith="STOPPED"
| streamstats count AS ID
| table _time TT ID
| mvexpand TT
| eval _time=TT
| timechart  values(ID) by ID

You will need to use a line chart, and in the options, choose to "connect missing values". This may not work exactly, but hopefully it will get close to what you want.