Splunk Search

How to draw a Chart with Duration field in HH:MM:SS format.

nandanthakkar
New Member

I have duration field in seconds. I can draw graph using that field. However, I want graph using duration field in HH:MM:SS format.

I tried below query:

search query | transaction maxevents=-1 Application
| chart sum(duration) as duration over Application | fieldformat duration=tostring( duration , "duration")

I get statistics, but I do not get visualization.

Thank you so much.

0 Karma

ddrillic
Ultra Champion

Oh, | eval field_in_hhmmss=tostring(field_in_secs, "duration") based on How to convert second to HH:MM:SS format in the exported search result?

I just tried | eval field_in_hhmmss=tostring(10000, "duration") and it's good ; - )

0 Karma

niketn
Legend

@ddrillic, if your problem is resolved, please convert your comment to answer and accept the same to mark this question as answered.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

ddrillic
Ultra Champion

@nandanthakkar - please accept if the advice solved your issue...

0 Karma

nandanthakkar
New Member

I am sorry for delayed response. I do get a field in HHMMSS format in table/ statistics tab using the code that you suggested. However, I am unable to use field_in_hhmmss in visualization. I want duration in visualization in HHMMSS format. I only able to make visualization using duration in seconds. Please help me to put duration in HHMMSS format on visualization

0 Karma

ddrillic
Ultra Champion

What do you have in the field duration to begin with?

0 Karma

nandanthakkar
New Member

num of seconds in duration field.

0 Karma

nandanthakkar
New Member

It is decimal.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...