topic Re: How to plot duration on y-axis? in Splunk Search

How to plot duration on y-axis?

splunkIT — Tue, 14 Apr 2015 19:35:50 GMT

I have a simple search like this:



index=main sourcetype=test | table date_mday, Duration

Note: the values for Duration are in time format (hh:mm:ss)

When I create a line chart, nothing appears on the chart.

Re: How to plot duration on y-axis?

Flynt — Tue, 14 Apr 2015 19:40:29 GMT

Duration is a string so this would have to be converted in order to plot correctly.

One way to do this is convert the duration to seconds and then plot from there. For instance if your results return a Duration field (along with date_mday)

yoursearch |dedup date_mday| table Duration, date_mday|rex field=Duration "(?<hour>^.+):(?<min>.+):(?<sec>.+$)"|eval hour=hour*60*60|eval min=min*60|eval Duration=round(((hour+min+sec)/60),2)|table date_mday, Duration|sort + date_mday

This should chart the Duration in minutes (that's where our /60 in the last eval statement comes in) on the y axis over the date_mday on the x axis

Re: How to plot duration on y-axis?

splunkIT — Mon, 28 Sep 2020 19:32:04 GMT

Yup. @Flynt's suggestion is working for me. You rock, dude 🙂
I did remove the first table command just to tidy up things a bit:



yoursearch |dedup date_mday| rex field=Duration "(?^.+):(?.+):(?.+$)"|eval hour=hour*60*60|eval min=min*60|eval Duration=round(((hour+min+sec)/60),2)|table date_mday, Duration|sort + date_mday

Re: How to plot duration on y-axis?

Flynt — Tue, 14 Apr 2015 19:58:36 GMT

Err. You could also do it simply with Convert- Sorry didn't think about this one until I looked at all those evals. dur2sec will also take into account days if they exist in the Duration field.

yoursearch |dedup date_mday|convert dur2sec(Duration) |table date_mday, Duration|eval Duration=round(((Duration)/60),2)|sort + date_mday

Re: How to plot duration on y-axis?

Flynt — Tue, 14 Apr 2015 20:02:47 GMT

My second answer is actually cleaner and more effective.