I have duration field in seconds. I can draw graph using that field. However, I want graph using duration field in HH:MM:SS format.
I tried below query:
search query | transaction maxevents=-1 Application
| chart sum(duration) as duration over Application | fieldformat duration=tostring( duration , "duration")
I get statistics, but I do not get visualization.
Thank you so much.
Oh, | eval field_in_hhmmss=tostring(field_in_secs, "duration")
based on How to convert second to HH:MM:SS format in the exported search result?
I just tried | eval field_in_hhmmss=tostring(10000, "duration")
and it's good ; - )
@ddrillic, if your problem is resolved, please convert your comment to answer and accept the same to mark this question as answered.
@nandanthakkar - please accept if the advice solved your issue...
I am sorry for delayed response. I do get a field in HHMMSS format in table/ statistics tab using the code that you suggested. However, I am unable to use field_in_hhmmss in visualization. I want duration in visualization in HHMMSS format. I only able to make visualization using duration in seconds. Please help me to put duration in HHMMSS format on visualization
What do you have in the field duration
to begin with?
num of seconds in duration field.
It is decimal.