Dashboards & Visualizations

Displaying duration in human-readable format instead of seconds on chart by axis Y?

greg
Communicator

I have an advanced XML chart that displays duration in seconds on axis Y.

Sometimes, when the values are high, axis labels become difficult to interpret:

alt text

Can I set the labels in human-readable format, in appropriate value range, like this:

alt text

So far I've just set the axis type as

<param name="charting.axisY">time</param>

to have duration converted to epoch time (starting from 1970-10-01).

However for big duration values my workaround doesn't look very well since full date timestamps are included into label markers for the bottom and top values on the Y-axis.

alt text

Is there any way to configure a label convertor for the proper time scale?

lguinn2
Legend

In the search, where you are calculating the duration, can you add

 | fieldformat timeVariable = tostring(timeVariable,"duration")

I don't know if this will help on the chart in advanced XML, but it would make the durations look better in a table...

lguinn2
Legend

I don't think there is a way to use one representation (such as epoch time) for the data values and a different (though corresponding) representation for the scale... if fieldformat doesn't do it, then I don't know what will.

0 Karma

greg
Communicator

As for the tabular data, yes, I've already done so.
But still looking for a solution on axis labels...

Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...