Splunk Search

Timeline App duration problem

MaryvonneMB
Path Finder

Hi everyone!

I'm trying to use Timeline module but I have some trouble with the duration:
Note: I'm working with a lookup file

So, I have start and end contract date for some object, and obviously, I would like to see on a timeline when a contract start and end.
I do the following:
convert timeformat=%Y-%m-%d mktime(timeDate) mktime(endDate) | eval diff=(endDate-timeDate) |table timeDate, "Contract #", diff
I have a timeline but, for example: I have a contract starting at 2009-10-01 and ending at 2014-10-31. The diff value in seconds is correct but, on the timeline it represent only 1day. I don't understand where the problem is. (By the way, every starting date is correctly put on the timeline

Thanks in advance

0 Karma
1 Solution

MaryvonneMB
Path Finder

In fact, a collegue help me and find that we have to do the following: eval diff=(endDate-timeDate) * 1000
With this multiplication the results are well design. But he doesn't know why we have to do this. If anyone has an idea, the answer will be welcome!

View solution in original post

0 Karma

MaryvonneMB
Path Finder

In fact, a collegue help me and find that we have to do the following: eval diff=(endDate-timeDate) * 1000
With this multiplication the results are well design. But he doesn't know why we have to do this. If anyone has an idea, the answer will be welcome!

View solution in original post

0 Karma

chchu_splunk
Splunk Employee
Splunk Employee

Late answer to an old post.

I had the same issue and it appears that the duration requires the resulting field in milliseconds rather than seconds, so multiplying your result by 1000 makes it work.

https://docs.splunk.com/Documentation/Timeline/1.3.0/TimelineViz/TimelineSearchDataFormat

0 Karma

woodcock
Esteemed Legend

What visualization are you using?

0 Karma

MaryvonneMB
Path Finder

I'm using the Timeline - Custom Vizualisation App from Splunk 6.4

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.