Make a graph

[hxa27]

Hi, I am using this query

sourcetype=TraceDropOff| transaction startswith="Starting Main" endswith="DropOff application execution complete" |eval "Event End Time"=strftime(_time+duration, "%m-%d-%Y %H:%M:%S")|eval "Event Start Time"=strftime(_time, "%m-%d-%Y %H:%M:%S")| rename source as "Log Location" | eval Duration(Seconds)=strftime(duration,"%M:%S") | table "Log Location","Event Start Time","Event End Time", Duration(Seconds)

and I am trying to graph the Duration(second) column with the Log Location but since these are not fields am not able to graph my data. Any suggestion??

Thanks

[martin_mueller]

How 'bout this?

sourcetype=TraceDropOff | transaction startswith="Starting Main" endswith="DropOff application execution complete" | timechart avg(duration) by source

[martin_mueller]

Add this after the timechart:

... | eval duration = duration / 60 | rename duration as "Duration in minutes"

[hxa27]

ok, and how can I do the minutes ?

[martin_mueller]

Showing the time in MM:SS on the Y axis isn't going to be easy, if at all possible with the built-in charting. Just go with either seconds or minutes, the viewer is going to understand it.

[hxa27]

Yes, and showing the time it takes as Y axis in minute ans second

[martin_mueller]

Sooo... You're looking for max(duration) instead of avg(duration)?

[hxa27]

we are trying to see how long it takes to receive the response. Then we can set up an alert whenever the process exceeds our max.The graph will be easier for us to read and compare .

[martin_mueller]

What should the graph look like instead?

[hxa27]

Thanks for the response

Probably you misunderstood my question.I am trying to graph the result of each duration but the query you wrote is giving the avg duration.

Thanks again