Splunk Search

Timeline App duration problem

MaryvonneMB
Path Finder

Hi everyone!

I'm trying to use Timeline module but I have some trouble with the duration:
Note: I'm working with a lookup file

So, I have start and end contract date for some object, and obviously, I would like to see on a timeline when a contract start and end.
I do the following:
convert timeformat=%Y-%m-%d mktime(timeDate) mktime(endDate) | eval diff=(endDate-timeDate) |table timeDate, "Contract #", diff
I have a timeline but, for example: I have a contract starting at 2009-10-01 and ending at 2014-10-31. The diff value in seconds is correct but, on the timeline it represent only 1day. I don't understand where the problem is. (By the way, every starting date is correctly put on the timeline

Thanks in advance

0 Karma
1 Solution

MaryvonneMB
Path Finder

In fact, a collegue help me and find that we have to do the following: eval diff=(endDate-timeDate) * 1000
With this multiplication the results are well design. But he doesn't know why we have to do this. If anyone has an idea, the answer will be welcome!

View solution in original post

0 Karma

MaryvonneMB
Path Finder

In fact, a collegue help me and find that we have to do the following: eval diff=(endDate-timeDate) * 1000
With this multiplication the results are well design. But he doesn't know why we have to do this. If anyone has an idea, the answer will be welcome!

0 Karma

chchu_splunk
Splunk Employee
Splunk Employee

Late answer to an old post.

I had the same issue and it appears that the duration requires the resulting field in milliseconds rather than seconds, so multiplying your result by 1000 makes it work.

https://docs.splunk.com/Documentation/Timeline/1.3.0/TimelineViz/TimelineSearchDataFormat

0 Karma

woodcock
Esteemed Legend

What visualization are you using?

0 Karma

MaryvonneMB
Path Finder

I'm using the Timeline - Custom Vizualisation App from Splunk 6.4

0 Karma
Get Updates on the Splunk Community!

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...