I have a simple lookup query as follows :-
| inputlookup ABC.csv
which gives the result as follows :-
Which doesn't give me any visualization. Now how can I get a "Line Chart" visualization with 3 line patterns like "time-to-close", "time-to-discover" and "time-to-respond"
I assume the current time format for all the 3 columns should be converted to a unique value either by seconds or by minutes inorder to get any visualization like "1 d,0 h, 0 m and 0 s" as "86400s" but I'm not sure how to get the eval logic for that.
Any help would be great.
Try this and if it works for you, then convert all fields similar to this
|stats count|eval time_to_close="1 d,0 h, 0 m and 1 s"|eval time_to_close=split(replace(replace(time_to_close," ",":"),",",":"),":")
|eval time_to_close_sec=tonumber(mvindex(time_to_close,0))*86400+tonumber(mvindex(time_to_close,2))*3600+tonumber(mvindex(time_to_close,5))*60+tonumber(mvindex(time_to_close,8))
Hi,
what about this?
| makeresults | eval Parameter="321 d, 10 h, 48 m and 46 s" |eval ts=strptime(Parameter,"%j d, %H h, %M m and %S s")
ts is what you need
@poete I have more than 40 rows. The above solution gives me the solution for just row 1 . Here I want to use the lookup table results (40 rows) and then convert them in a new row. Is there any possibility to get the required result.
Try this and if it works for you, then convert all fields similar to this
|stats count|eval time_to_close="1 d,0 h, 0 m and 1 s"|eval time_to_close=split(replace(replace(time_to_close," ",":"),",",":"),":")
|eval time_to_close_sec=tonumber(mvindex(time_to_close,0))*86400+tonumber(mvindex(time_to_close,2))*3600+tonumber(mvindex(time_to_close,5))*60+tonumber(mvindex(time_to_close,8))
@renjith.nair I have more than 40 rows. The above solution gives me the solution for just row "1 d,0 h, 0 m and 1 s" . Here I want to use the lookup table results (40 rows) and then convert them in a new row. Is there any possibility to get the required result.