Hi, This should be easy, but I'm getting confused making it work. I have the following:
Time: 01:00 PM Event: STARTED Time: 01:35 PM Event: STOPPED TIme: 04:00 PM Event: STARTED Time: 04:30 PM Event: STOPPED
Given I have two fields, Time and Event. I want a solid line chart showing the range of time an Event STARTED and an Event STOPPED.
It's actually not that easy for Splunk. A timechart has a continuous timeline across the x-axis. But what Splunk sees with these 4 events is simply 4 points in time, with nothing in between. So you could do a chart, but how would Splunk know to fill in at 1:01 but not at 1:40? Also, you really need an event identifier - what if events overlap?
So try this
yoursearchhere | eval TT=_time | transaction startswith="STARTED" endswith="STOPPED" | streamstats count AS ID | table _time TT ID | mvexpand TT | eval _time=TT | timechart values(ID) by ID
You will need to use a line chart, and in the options, choose to "connect missing values". This may not work exactly, but hopefully it will get close to what you want.
Try to use transaction something like this ...
...| eval newfield="newfield"| transaction newfield startswith="STARTED" endswith="stoped" | table duration
it will give you autogenerated duration field (range between stopped and started)
oh, I was late with answer publication for 1 minute