Splunk Search

How can I change bar chart interval to time duration?

tamduong16
Contributor

I have the following search:

...| convert dur2sec("Call Duration") as "CDinsec" | stats sum(CDinsec) as "totalCDsec", avg(CDinsec) as "avgCDinsec" by Company

which give me this result:

alt text

How can I change the value from totalCDsec and avgCDinsec (currently in second) to duration so that I could put it in a double column bar chart?

0 Karma

woodcock
Esteemed Legend

To change to duration when displayed (so that all charting functions still work), do this:

| fieldformat totalCDsec=tostring(totalCDsec,"duration")
0 Karma

somesoni2
Revered Legend

YOu can convert using eval-tostring function but once converted to duration (string), you won't be able to plot it in chart (chart series should've numerical values). FYI, the conversion to duration would be like this: | eval totalCDsec=tostring(totalCDsec,"duration")

tamduong16
Contributor

thanks! But do you think I could convert from that tostring to duration?

0 Karma

somesoni2
Revered Legend

You can using the eval syntax I provided. Will work for table visualization.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...