topic Re: How can I use a Chart Overlay with an epoch field and convert it to a human readable format? in Splunk Search

How can I use a Chart Overlay with an epoch field and convert it to a human readable format?

felipesewaybric — Mon, 13 Jul 2015 17:27:52 GMT

How can I use Chart Overlay with an epoch field converting the same in time?

I have 2 fields, one is Intevalo with epoch time, and the other called Tempo Limite with the epoch turned into time with 'duration'.

How can I set the chart overlay to time, like 01:22:04 or something like that.

Re: How can I use a Chart Overlay with an epoch field and convert it to a human readable format?

aljohnson_splun — Mon, 13 Jul 2015 17:32:14 GMT

EDITED:

I don't know if you can do this. Every attempt I've made at changing this value into a string breaks the overlay.

Maybe the closest thing is just converting those seconds to minutes...

... | eval duration = round(duration/60, 2)

Re: How can I use a Chart Overlay with an epoch field and convert it to a human readable format?

felipesewaybric — Mon, 13 Jul 2015 17:34:10 GMT

That works only in the table, but not with chart overlay

Re: How can I use a Chart Overlay with an epoch field and convert it to a human readable format?

aljohnson_splun — Mon, 13 Jul 2015 17:35:05 GMT

Did you try selecting formatted_time in the chart overlay field input in the visualization formatting drop down menu ? It should work for both.

Re: How can I use a Chart Overlay with an epoch field and convert it to a human readable format?

felipesewaybric — Tue, 29 Sep 2020 06:40:11 GMT

yes, and wont work, only apears in the epoch time, example:

with formatted_time -> 02:08:00 wont show the line
without formatted_time -> 18480.639752 show the line

Re: How can I use a Chart Overlay with an epoch field and convert it to a human readable format?

aljohnson_splun — Mon, 13 Jul 2015 18:57:01 GMT

Hmm. Can you edit your original question - please add your search and talk about what other values are present (like, whats on the x axis)

Re: How can I use a Chart Overlay with an epoch field and convert it to a human readable format?

felipesewaybric — Mon, 13 Jul 2015 19:56:06 GMT

Re: How can I use a Chart Overlay with an epoch field and convert it to a human readable format?

felipesewaybric — Mon, 13 Jul 2015 19:57:29 GMT

The chart.overlay (Intervalo) only show when is in the epoch format, but i need something like %T when you mouse over in the overlay

Re: How can I use a Chart Overlay with an epoch field and convert it to a human readable format?

aljohnson_splun — Mon, 13 Jul 2015 20:01:18 GMT

I think see the problem. As for the dentro do tempo medio and Intervalo fields - those are numbers of seconds, right ? That is pretty different from epoch time.

So are you just trying to convert those seconds into hours, minutes? It sounded in you original question like you knew how to use eval to ge duration

... | eval Intervalo = tostring(Intervalo, "duration")

Or you could even try using fieldformat instead of eval, if need be ?

Re: How can I use a Chart Overlay with an epoch field and convert it to a human readable format?

felipesewaybric — Tue, 14 Jul 2015 13:27:07 GMT

i try already, but what i need is to show the time in the red line when mouseover, now, when i mouse over the red live Intervalo, it show only the seconds, like 1420.882232.

I know how to convert, the problemn is when is already converted, the red line disapear.

Re: How can I use a Chart Overlay with an epoch field and convert it to a human readable format?

aljohnson_splun — Tue, 14 Jul 2015 16:25:00 GMT

What about something even more simple?

| eval duration = round(Intervalo/60, 2)

That would just be minutes instead of seconds.

Re: How can I use a Chart Overlay with an epoch field and convert it to a human readable format?

felipesewaybric — Tue, 14 Jul 2015 18:16:09 GMT

there is a way to set to hours and minutes?

Re: How can I use a Chart Overlay with an epoch field and convert it to a human readable format?

aljohnson_splun — Tue, 14 Jul 2015 18:37:12 GMT

I think adding a string in there, in this case, the colon, will break the chart-ability of the field.

Re: How can I use a Chart Overlay with an epoch field and convert it to a human readable format?

felipesewaybric — Wed, 15 Jul 2015 14:13:32 GMT

True, this is how it ends:
| eval "Media Dia em Minutos" = round(duration/60, 2)

Thanks for the help.