https://community.splunk.com/t5/Splunk-Search/How-to-chart-elapsed-time-performance-data-from-dbquery/m-p/132470#M184591 <P>Try this:</P> <PRE><CODE>base search involving dbquery | rex field=timing "(?&lt;h&gt;\d+):(?&lt;m&gt;\d+):(?&lt;s&gt;\d+)" | eval duration = s + 60 * (m + 60 * h) | chart avg(duration) by Activity </CODE></PRE> Sun, 23 Nov 2014 17:39:19 GMT martin_mueller 2014-11-23T17:39:19Z https://community.splunk.com/t5/Splunk-Search/How-to-chart-elapsed-time-performance-data-from-dbquery/m-p/132469#M184590 <P>I've got a db query that returns an activity name and then the elapsed time of the activity that I would like to chart<BR /> date returned is in the following format</P> <P>Activity timing<BR /> a 0:0:33 (hh:m:ss)<BR /> b 0:0:54<BR /> c 0:1:23<BR /> d 0:0:2</P> <P>but when I give the query to the chart, it only puts the activities on the x axis.<BR /> I figure I need to tell the chart that the timing part of the data set is a timespan, I just don't know how to </P> Sun, 23 Nov 2014 17:03:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-chart-elapsed-time-performance-data-from-dbquery/m-p/132469#M184590 danoconnl 2014-11-23T17:03:01Z https://community.splunk.com/t5/Splunk-Search/How-to-chart-elapsed-time-performance-data-from-dbquery/m-p/132470#M184591 <P>Try this:</P> <PRE><CODE>base search involving dbquery | rex field=timing "(?&lt;h&gt;\d+):(?&lt;m&gt;\d+):(?&lt;s&gt;\d+)" | eval duration = s + 60 * (m + 60 * h) | chart avg(duration) by Activity </CODE></PRE> Sun, 23 Nov 2014 17:39:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-chart-elapsed-time-performance-data-from-dbquery/m-p/132470#M184591 martin_mueller 2014-11-23T17:39:19Z