https://community.splunk.com/t5/Splunk-Search/Chart-duration-of-process-over-time/m-p/50716#M12193 <P>Ok. you need to use convert to convert that field.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/convert">http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/convert</A></P> <P>so in yourcase experiment with convert dur2sec(LoadTime) or maybe mstime()</P> Thu, 06 Dec 2012 20:57:25 GMT RicoSuave 2012-12-06T20:57:25Z https://community.splunk.com/t5/Splunk-Search/Chart-duration-of-process-over-time/m-p/50714#M12191 <P>I've been messing with this all morning and still can't get the results I want. Why is this so difficult to achieve?</P> <P>I have a list of how long it took to load an index for some "users". Like this:</P> <PRE><CODE>00:15:27 aaa 00:15:07 bbb 00:10:56 ccc 00:29:36 ddd 00:24:13 eee 02:58:51 fff 00:38:33 ggg 00:21:29 hhh 00:17:44 iii </CODE></PRE> <P>I want to create a bar or line graph for this data spanning over a few days. I'd like to show how much time it took for say "aaa" to load this index over the course of 4 days. </P> <P>I'm having issues having splunk understand time formats and to display a scale of "time" based on the results, say like every 30 minutes on a chart....Do I have to convert the time to seconds, then back to a readable time for this to happen?</P> <P>I tried this search. I thought "eh, this is easy!" apparently not:</P> <PRE><CODE>sourcetype=edr daysago=4 | dedup LoadTime, users | timechart per_day(LoadTime) by users </CODE></PRE> <P>My results are not what i'm looking for . For example, one of the times is:</P> <PRE><CODE>00:21:29 hhh </CODE></PRE> <P>Splunk graphs it as: </P> <PRE><CODE>50424.000000 hhh </CODE></PRE> <P>How can I make a graph of this data for each user across a span of time in a format of time readable???</P> Fri, 30 Nov 2012 17:49:24 GMT https://community.splunk.com/t5/Splunk-Search/Chart-duration-of-process-over-time/m-p/50714#M12191 gnovak 2012-11-30T17:49:24Z https://community.splunk.com/t5/Splunk-Search/Chart-duration-of-process-over-time/m-p/50715#M12192 <P>anyone have any idea if this is even possible? Would like on the left side of graph to have actual times in a scale of say, 1 hour, 2 hours, 3 hours, etc...</P> Thu, 06 Dec 2012 18:38:36 GMT https://community.splunk.com/t5/Splunk-Search/Chart-duration-of-process-over-time/m-p/50715#M12192 gnovak 2012-12-06T18:38:36Z https://community.splunk.com/t5/Splunk-Search/Chart-duration-of-process-over-time/m-p/50716#M12193 <P>Ok. you need to use convert to convert that field.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/convert">http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/convert</A></P> <P>so in yourcase experiment with convert dur2sec(LoadTime) or maybe mstime()</P> Thu, 06 Dec 2012 20:57:25 GMT https://community.splunk.com/t5/Splunk-Search/Chart-duration-of-process-over-time/m-p/50716#M12193 RicoSuave 2012-12-06T20:57:25Z https://community.splunk.com/t5/Splunk-Search/Chart-duration-of-process-over-time/m-p/50717#M12194 <P>I'll try this!</P> Wed, 19 Dec 2012 20:52:35 GMT https://community.splunk.com/t5/Splunk-Search/Chart-duration-of-process-over-time/m-p/50717#M12194 gnovak 2012-12-19T20:52:35Z