I am monitoring 4 applications. Each application is assigned an unique name (like App1, App2) and each running instance will have an instance id (a distinct GUID - SVID) and I am logging when they are started and stopped. I am able to get the duration, start time and end times of applications using the following query.
| where like (MESSAGE, "%Started%") or like (MESSAGE, "%Disposed%") | transaction SVID | eval starttime=strftime(_time, "%D %H:%M:%S") | eval endtime= strftime(_time+duration, "%D %H:%M:%S") | table SVID starttime duration endtime
The table looks fine.
APP SVID Start Time Duration End Time
1 App1 3f3c74bf-375b-4442-bd38-b6a22092a2c2 10/04/13 12:26:11 2.646 10/04/13 12:26:13
2 App1 0705742b-4d45-4203-8229-4f1571952a49 10/04/13 12:25:24 13.066 10/04/13 12:25:38
3 App2 5ae6483e-7e24-4f0b-93f1-7c1c0bd94c49 10/04/13 10:54:25 0 10/04/13 10:54:25
I am tying to create a Chart, which shows the start and end times as follows.
|
| **************************************** ********** ***************
|
| ======= ==== ==== ===== =============================== =======
|
| ++++++++ ++++++++++++++++++++++++++ ++++ +++++++++ ++++++
|
|
|_______________________________________________________________________________________________
Time
* - App1
= - App2
+ - App3
Could you please help?
... View more