Splunk Search

Chart duration of process over time

gnovak
Builder

I've been messing with this all morning and still can't get the results I want. Why is this so difficult to achieve?

I have a list of how long it took to load an index for some "users". Like this:

00:15:27    aaa
00:15:07    bbb
00:10:56    ccc
00:29:36    ddd
00:24:13    eee
02:58:51    fff
00:38:33    ggg
00:21:29    hhh
00:17:44    iii

I want to create a bar or line graph for this data spanning over a few days. I'd like to show how much time it took for say "aaa" to load this index over the course of 4 days.

I'm having issues having splunk understand time formats and to display a scale of "time" based on the results, say like every 30 minutes on a chart....Do I have to convert the time to seconds, then back to a readable time for this to happen?

I tried this search. I thought "eh, this is easy!" apparently not:

sourcetype=edr daysago=4 | dedup LoadTime, users | timechart per_day(LoadTime) by users

My results are not what i'm looking for . For example, one of the times is:

00:21:29   hhh

Splunk graphs it as:

50424.000000   hhh

How can I make a graph of this data for each user across a span of time in a format of time readable???

Tags (1)
0 Karma

RicoSuave
Builder

Ok. you need to use convert to convert that field.

http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/convert

so in yourcase experiment with convert dur2sec(LoadTime) or maybe mstime()

0 Karma

gnovak
Builder

I'll try this!

0 Karma

gnovak
Builder

anyone have any idea if this is even possible? Would like on the left side of graph to have actual times in a scale of say, 1 hour, 2 hours, 3 hours, etc...

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...