Splunk Search

Plotting a timeline

ryanprayacn
Explorer

Hello:

I have a long row of time and dates for each overall "event". So the data looks like

8/11/2017 18:00:00 8/15/2017 04:00:00 8/19/2017 15:00:00

Can you recommend the best way to plot this information? I'm a little thrown off since I have multiple timestamps in one row.

Thanks!

0 Karma

ryanprayacn
Explorer

This one row represents one timeline for a process. In reality, the row has many more date and times but only listed a sample here for simplicity sake.

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

That depends entirely on what the three different timestamps are, and what information you are trying to impart to the viewer.

If they are the start, midpoint and end of some process, and you want to show how long the process is taking, then perhaps the average durations of the two segments is what you need to plot. Or perhaps you should throw out the middle segments and just plot the overall duration.

If they are the top n times in a race, then maybe the n times need to be plotted as n different horizontal bars, sorted into ascending order.

If they are n different readings that happen to be on a single record, then maybe each one needs to be broken into its own record and plotted as if it had been n records.

So, what are the times representing?

0 Karma

inventsekar
Ultra Champion

may you please clarify about the 3 timestamps on the given event, what each timestamp represents.. after understanding this, you can plan for a timeline easily.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...