Hi Guys,
Well, I have this structured log:
MEMBER, JOBNAME, JOBID, DATE_START, HOUR_START, DATE_END, HOUR_END, DURATION, GROUP, CPUTIME
PLCZBA20,PLCZBA20,21010,07/26/17,17:00,07/26/17,17:00,00:11,UAT,00:00.3
PLCADA20,PLCADA20,21008,07/26/17,17:00,07/26/17,17:00,00:11,UAT,00:00.4
And I'm trying to create next chart (for example):
I comment on them, the field DURATION is in the following format %M:%S and fields HOUR_START & HOUR_END in %H:M%,
now the field _time take correctly start date and time.
I was trying with this query, but it didn't convert to display time in the Y-axis and I'm not sure if this is the right way.
MYSEARCH
| bucket _time span=1d
| rex field=DURATION "(?<Mins>.{2}+):(?<Sec>.{2}+)"
| fillnull value=0
| eval secs=Mins*60+Sec
| eval duration = secs * 1000
| stats count by _time, duration, "JOBNAME"
| table _time "JOBNAME" duration
| convert timeformat="%H:%M" ctime(duration) AS duration
| chart max(duration) over _time by JOBNAME
Can someone help me please!!
regards..
... View more
