Splunk Search

Timeline App duration problem

Path Finder

Hi everyone!

I'm trying to use Timeline module but I have some trouble with the duration:
Note: I'm working with a lookup file

So, I have start and end contract date for some object, and obviously, I would like to see on a timeline when a contract start and end.
I do the following:
convert timeformat=%Y-%m-%d mktime(timeDate) mktime(endDate) | eval diff=(endDate-timeDate) |table timeDate, "Contract #", diff
I have a timeline but, for example: I have a contract starting at 2009-10-01 and ending at 2014-10-31. The diff value in seconds is correct but, on the timeline it represent only 1day. I don't understand where the problem is. (By the way, every starting date is correctly put on the timeline

Thanks in advance

0 Karma
1 Solution

Path Finder

In fact, a collegue help me and find that we have to do the following: eval diff=(endDate-timeDate) * 1000
With this multiplication the results are well design. But he doesn't know why we have to do this. If anyone has an idea, the answer will be welcome!

View solution in original post

0 Karma

Path Finder

In fact, a collegue help me and find that we have to do the following: eval diff=(endDate-timeDate) * 1000
With this multiplication the results are well design. But he doesn't know why we have to do this. If anyone has an idea, the answer will be welcome!

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

Late answer to an old post.

I had the same issue and it appears that the duration requires the resulting field in milliseconds rather than seconds, so multiplying your result by 1000 makes it work.

https://docs.splunk.com/Documentation/Timeline/1.3.0/TimelineViz/TimelineSearchDataFormat

0 Karma

Esteemed Legend

What visualization are you using?

0 Karma

Path Finder

I'm using the Timeline - Custom Vizualisation App from Splunk 6.4

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!