I have a time field in the format 00:07:34.271009 format.
I want to plot the time on y-axis of a line chart and tried to convert using | eval timeinmin=time/60 but it gives an empty value
How do I convert above mentioned time format to be able to be plotted on a chart?
You can use timechart and specify a span of 1 minute. For example:
<your search>
| timechart count span=1m
Like this:
| makeresults
| eval time="00:07:34.271009"
| rex field=time "(?J)(?:(?<tt_hours>\d+):(?<tt_minutes>\d+):)?(?:(?<tt_minutes>\d+):)?(?<tt_seconds>.+)$"
| fillnull value=0 tt_hours tt_minutes
| eval _time = tt_seconds + (60 * (tt_minutes + (60 * tt_hours))) + relative_time(now(), "@d")