Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Swimlanes in Splunk Enterprise

$
0
0
Hello, My business requirement is to have a view that shows the number of batch jobs on the Y-axis and the Time (in hour) on the X-axis. The rows events I have is looks something like below: 2016-06-20T12:01:46.000 JOB_ID=1 JOB_START_TIME=1466438400.000 JOB_END_TIME=1466442106.714 JOB_NAME=Hello_job For this event, _time is based on when the row is inserted to the database table which gets updated once the job finishes executing. From this event, what I need to do is: 1) Grab the start time and the end time 2) Divide the difference between start time and end time by hours 3) Tag the event with the hours 4) Increment a count for each of those hours for this job There are multiple jobs running the system, so I might need to find the min or start times and max of end times to find out the entire range. If I select for yesterday's time in the dashboard (_time), then it should show me all the jobs that had completed yesterday with a swim lane of number of jobs executing at a given hour. Example: _time Job ID Job_Start_time Job_End_time 6/16/2016 1:30 AM Job 1 6/15/2016 11:00 PM 6/16/2016 1:20 AM 6/16/2016 3:55 AM Job 2 6/16/2016 1:00 AM 6/16/2016 3:50 AM 6/16/2016 3:56 AM Job 3 6/16/2016 2:00 AM 6/16/2016 3:55 AM 6/16/2016 4:12 AM Job 3 6/16/2016 3:20 AM 6/16/2016 4:10 AM The chart should be like following: Job1 | 1 1 0 0 0 Job2 | 0 1 1 1 1 Job3 | 0 0 1 2 1 ------------------------------------------- hrs== 12 1 2 3 4 Note that there were total of two Job3 executing between 3 AM to 4 AM timeframe which shows up in the chart. I guess it's hard to explain, but let me know if you have any questions to solve this puzzle Appreciate your help.

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>