Hi I have a dashboard created with a PIE chart. I want to add on the dashboard start and end time for which this pie chart is created. Let us say this chart is created for doing a 24 hrs data analysis and creating the PIE chart. Start time : now-24h End Time: Now displayed above the Pie chart. if that is not possible at least I need that start and end time printed on somewhere in the chart when I send it as email PDF to clients. so they know this report is for the data period starting and ending used ... View more

Log data example: {'job_no':'1','begin_build_time':'2019-08-15 11:00:00','event_type':'staging'} {'job_no':'1','end_build_time':'2019-08-15 11:10:00','event_type':'staging'} {'job_no':'1','begin_execution_time':'2019-08-15 11:10:01','event_type':'transaction'} {'job_no':'1','end_execution_time':'2019-08-15 11:20:00','event_type':'transaction'} {'job_no':'1','begin_artifact_time':'2019-08-15 11:20:01','event_type':'upload'} {'job_no':'1','end_artifact_time':'2019-08-15 11:30:00','event_type':'upload'} I need data table output like: Job# 1 staging 10 mins transaction 10 mins upload 10 mins total 30 mins Each line is coming as a event in Splunk. I know we have to use coalesce and streamstats, but I am new to splunk not able to figure out how to get to this level. Thanks in advance. ... View more