Splunk Search

Line Chart Time Between Two Searched Fields

chrisboy68
Contributor

Hi, This should be easy, but I'm getting confused making it work. I have the following:

Time: 01:00 PM Event: STARTED
Time: 01:35 PM Event: STOPPED
TIme: 04:00 PM Event: STARTED
Time: 04:30 PM Event: STOPPED

Given I have two fields, Time and Event. I want a solid line chart showing the range of time an Event STARTED and an Event STOPPED.

Any pointers?

Thank you,

Chris

0 Karma

andrey2007
Contributor

Try to use transaction something like this ...
...| eval newfield="newfield"| transaction newfield startswith="STARTED" endswith="stoped" | table duration
it will give you autogenerated duration field (range between stopped and started)

oh, I was late with answer publication for 1 minute

0 Karma

chrisboy68
Contributor

Thank you very much for the response. I'm going to dig into both suggestions!

Chris

0 Karma

lguinn2
Legend

It's actually not that easy for Splunk. A timechart has a continuous timeline across the x-axis. But what Splunk sees with these 4 events is simply 4 points in time, with nothing in between. So you could do a chart, but how would Splunk know to fill in at 1:01 but not at 1:40? Also, you really need an event identifier - what if events overlap?

So try this

yoursearchhere
| eval TT=_time 
| transaction startswith="STARTED" endswith="STOPPED"
| streamstats count AS ID
| table _time TT ID
| mvexpand TT
| eval _time=TT
| timechart  values(ID) by ID

You will need to use a line chart, and in the options, choose to "connect missing values". This may not work exactly, but hopefully it will get close to what you want.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...