Splunk Search

Create a graph with time fields different than event's timestamp

edrivera3
Builder

Hi
In my events I have the following fields:
1. Initial_time (This is different than event's timestamp) (format=string)
2. End_time (This is different than event's timestamp) (format=string)
3. Process Name (format=string)

I am interested to create a graph which has time in x-axis and process names in y-axis. I want to show the multiple processes and duration time of each of them in the graph. I am not sure if this possible.

I already strptime() both time fields so now I can manipulate them.

If this is not possible. Is there a way to get something similar with a different graph. I want to see the duration of each of the process simultaneously and see if they overlap during some period of time.

0 Karma

stephane_cyrill
Builder

try this:
..........|stats .......................over yourField

0 Karma

edrivera3
Builder

I do not understand your answer. Could you explain how your answer could help me?

0 Karma

edrivera3
Builder

This is what I have already:
(Both time fields are multivalue fields so I am only interested in the minimum value of ini_time and maximum value of end_time.)

...| eval ini_stamp=strptime(ini_time,"%b %d %H:%M:%S %Y") | eval end_stamp=strptime(end_time,"%b %d %H:%M:%S %Y") | stats max(end_stamp) AS high min(ini_stamp) AS low by process_name| eval duration = high - low

So basically I also have the duration time of process_name

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...