topic Re: format timechart fields in Dashboards & Visualizations

format timechart fields

stwong — Tue, 27 Jun 2017 14:37:24 GMT

Hi all,

In a query "...| timechart span=1d sum(duration) as Duration by type ", possible to format the "sum(duration)" in the format of HH:MM:SS and display in both the Statistics and Visualization tab?

Sorry for the newbie question.
Thanks and regards

Re: format timechart fields

richgalloway — Tue, 27 Jun 2017 14:44:48 GMT

Try fieldformat.

...| timechart span=1d sum(duration) as Duration by type | fieldformat Duration=strftime(Duration, "%H:%M:%S")

Re: format timechart fields

somesoni2 — Tue, 27 Jun 2017 14:58:30 GMT

I believe you want to use strftime instead of strptime.

Re: format timechart fields

richgalloway — Tue, 27 Jun 2017 15:00:00 GMT

Thanks, somesoni2. Answer corrected.

Re: format timechart fields

stwong — Tue, 27 Jun 2017 15:21:16 GMT

Thanks a lot, but seems the output doesn't change after added fieldformat:

...|transaction ...| timechart span=1d sum(duration) as Duration by type | fieldformat Duration=strftime(Duration, "%H:%M:%S")

Did I miss anything?
Thanks again.

Best Regards

Re: format timechart fields

richgalloway — Tue, 27 Jun 2017 16:35:58 GMT

You didn't miss anything. Perhaps timechart doesn't honor fieldformat settings.

Re: format timechart fields

stwong — Wed, 28 Jun 2017 14:11:29 GMT

I changed to following and seems to work:

bucket span=1d _time| stats sum(duration) as Duration by type, _time | fieldformat Duration=strftime(Duration, "%H:%M:%S")

Again, anything missed?

Thanks a lot for all of your help.