Splunk Search

Why is the field format not working on our timechart search?

georgiahurst
Engager

I'm trying to plot the duration open for some of my data. I initially converted the open and close times to UNIX data forms, then find the difference, then create a timechart for using the average duration open per day, for each specific error. This is up until the final pipe in the plot below and plots fine.

The issues come when I try and use fieldformat. Instead of the y-axis being in UNIX time format, I want it to be in days, hours, minutes and seconds formats and it will not plot that way. I have tried to use the tostring and strptime formats (see below), however it does not plot as I want.

This part is all good

index="special_index" sourcetype=* | 
eval TimeOpenedAt = strptime('Data.opened_at', "%Y-%m-%d %H:%M:%S")| 
eval TimeClosedAt = strptime('Data.closed_at', "%Y-%m-%d %H:%M:%S") | 
eval TimeToCloseUNIX = TimeClosedAt - TimeOpenedAt | 
bin _time span=1d  | 
timechart avg(TimeToCloseUNIX) as TimeToCloseUNIXAvg by ErrorType | 

What I have tried

fieldformat TimeToCloseUNIXAvg=tostring(TimeToCloseUNIXAvg,"duration")

and

fieldformat TimeToCloseUNIXAvg=strftime(TimeToCloseUNIXAvg,"+%j.%H:%M:%S")

Any help would be gratefully appreciated!

0 Karma
1 Solution

woodcock
Esteemed Legend

The Line Chart visualization can only plot numbers on the Y-axis. If you think about it, it totally makes sense. IMHO, it would be nice if it supported fieldformat so that when it showed the values to use (at least when hovering), the could be formatted differently.
Vote here:
https://ideas.splunk.com/ideas/EID-I-97

View solution in original post

woodcock
Esteemed Legend

The Line Chart visualization can only plot numbers on the Y-axis. If you think about it, it totally makes sense. IMHO, it would be nice if it supported fieldformat so that when it showed the values to use (at least when hovering), the could be formatted differently.
Vote here:
https://ideas.splunk.com/ideas/EID-I-97

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...