Duration is a string so this would have to be converted in order to plot correctly.
One way to do this is convert the duration to seconds and then plot from there. For instance if your results return a Duration field (along with date_mday)
yoursearch |dedup date_mday| table Duration, date_mday|rex field=Duration "(?<hour>^.+):(?<min>.+):(?<sec>.+$)"|eval hour=hour*60*60|eval min=min*60|eval Duration=round(((hour+min+sec)/60),2)|table date_mday, Duration|sort + date_mday
This should chart the Duration in minutes (that's where our /60 in the last eval statement comes in) on the y axis over the date_mday on the x axis
Err. You could also do it simply with Convert- Sorry didn't think about this one until I looked at all those evals. dur2sec will also take into account days if they exist in the Duration field.
yoursearch |dedup date_mday|convert dur2sec(Duration) |table date_mday, Duration|eval Duration=round(((Duration)/60),2)|sort + date_mday
Duration is a string so this would have to be converted in order to plot correctly.
One way to do this is convert the duration to seconds and then plot from there. For instance if your results return a Duration field (along with date_mday)
yoursearch |dedup date_mday| table Duration, date_mday|rex field=Duration "(?<hour>^.+):(?<min>.+):(?<sec>.+$)"|eval hour=hour*60*60|eval min=min*60|eval Duration=round(((hour+min+sec)/60),2)|table date_mday, Duration|sort + date_mday
This should chart the Duration in minutes (that's where our /60 in the last eval statement comes in) on the y axis over the date_mday on the x axis
Yup. @Flynt's suggestion is working for me. You rock, dude 🙂
I did remove the first table command just to tidy up things a bit:
yoursearch |dedup date_mday| rex field=Duration "(?^.+):(?.+):(?.+$)"|eval hour=hour*60*60|eval min=min*60|eval Duration=round(((hour+min+sec)/60),2)|table date_mday, Duration|sort + date_mday
My second answer is actually cleaner and more effective.