- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: How to draw a Chart with Duration field in HH:...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to draw a Chart with Duration field in HH:MM:SS format.
I have duration field in seconds. I can draw graph using that field. However, I want graph using duration field in HH:MM:SS format.
I tried below query:
search query | transaction maxevents=-1 Application
| chart sum(duration) as duration over Application | fieldformat duration=tostring( duration , "duration")
I get statistics, but I do not get visualization.
Thank you so much.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Oh, | eval field_in_hhmmss=tostring(field_in_secs, "duration") based on How to convert second to HH:MM:SS format in the exported search result?
I just tried | eval field_in_hhmmss=tostring(10000, "duration") and it's good ; - )
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@ddrillic, if your problem is resolved, please convert your comment to answer and accept the same to mark this question as answered.
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@nandanthakkar - please accept if the advice solved your issue...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am sorry for delayed response. I do get a field in HHMMSS format in table/ statistics tab using the code that you suggested. However, I am unable to use field_in_hhmmss in visualization. I want duration in visualization in HHMMSS format. I only able to make visualization using duration in seconds. Please help me to put duration in HHMMSS format on visualization
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What do you have in the field duration to begin with?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
num of seconds in duration field.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It is decimal.
Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!
They're back! Join the SplunkTrust and MVP at .conf24
Enterprise Security Content Update (ESCU) | New Releases
