Splunk Search

Plotting a timeline

ryanprayacn
Explorer

Hello:

I have a long row of time and dates for each overall "event". So the data looks like

8/11/2017 18:00:00 8/15/2017 04:00:00 8/19/2017 15:00:00

Can you recommend the best way to plot this information? I'm a little thrown off since I have multiple timestamps in one row.

Thanks!

0 Karma

ryanprayacn
Explorer

This one row represents one timeline for a process. In reality, the row has many more date and times but only listed a sample here for simplicity sake.

0 Karma

DalJeanis
Legend

That depends entirely on what the three different timestamps are, and what information you are trying to impart to the viewer.

If they are the start, midpoint and end of some process, and you want to show how long the process is taking, then perhaps the average durations of the two segments is what you need to plot. Or perhaps you should throw out the middle segments and just plot the overall duration.

If they are the top n times in a race, then maybe the n times need to be plotted as n different horizontal bars, sorted into ascending order.

If they are n different readings that happen to be on a single record, then maybe each one needs to be broken into its own record and plotted as if it had been n records.

So, what are the times representing?

0 Karma

inventsekar
SplunkTrust
SplunkTrust

may you please clarify about the 3 timestamps on the given event, what each timestamp represents.. after understanding this, you can plan for a timeline easily.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Agent Mode Engaged! Enchaining Agentic Operations with Splunk AI Assistant 2.0

    Are you ready to transform how your team handles complex data requests? We invite you to our upcoming ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...