Splunk Search
Highlighted

Plotting a timeline

Explorer

Hello:

I have a long row of time and dates for each overall "event". So the data looks like

8/11/2017 18:00:00 8/15/2017 04:00:00 8/19/2017 15:00:00

Can you recommend the best way to plot this information? I'm a little thrown off since I have multiple timestamps in one row.

Thanks!

0 Karma
Highlighted

Re: Plotting a timeline

Champion

may you please clarify about the 3 timestamps on the given event, what each timestamp represents.. after understanding this, you can plan for a timeline easily.

0 Karma
Highlighted

Re: Plotting a timeline

SplunkTrust
SplunkTrust

That depends entirely on what the three different timestamps are, and what information you are trying to impart to the viewer.

If they are the start, midpoint and end of some process, and you want to show how long the process is taking, then perhaps the average durations of the two segments is what you need to plot. Or perhaps you should throw out the middle segments and just plot the overall duration.

If they are the top n times in a race, then maybe the n times need to be plotted as n different horizontal bars, sorted into ascending order.

If they are n different readings that happen to be on a single record, then maybe each one needs to be broken into its own record and plotted as if it had been n records.

So, what are the times representing?

0 Karma
Highlighted

Re: Plotting a timeline

Explorer

This one row represents one timeline for a process. In reality, the row has many more date and times but only listed a sample here for simplicity sake.

0 Karma