Archive

format timechart fields

Communicator

Hi all,

In a query "...| timechart span=1d sum(duration) as Duration by type ", possible to format the "sum(duration)" in the format of HH:MM:SS and display in both the Statistics and Visualization tab?

Sorry for the newbie question.
Thanks and regards

Tags (1)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try fieldformat.

...| timechart span=1d sum(duration) as Duration by type | fieldformat Duration=strftime(Duration, "%H:%M:%S")
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Try fieldformat.

...| timechart span=1d sum(duration) as Duration by type | fieldformat Duration=strftime(Duration, "%H:%M:%S")
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

I believe you want to use strftime instead of strptime.

0 Karma

Communicator

Thanks a lot, but seems the output doesn't change after added fieldformat:

...|transaction ...| timechart span=1d sum(duration) as Duration by type | fieldformat Duration=strftime(Duration, "%H:%M:%S")

Did I miss anything?
Thanks again.

Best Regards

0 Karma

SplunkTrust
SplunkTrust

You didn't miss anything. Perhaps timechart doesn't honor fieldformat settings.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Communicator

I changed to following and seems to work:

bucket span=1d _time| stats sum(duration) as Duration by type, _time | fieldformat Duration=strftime(Duration, "%H:%M:%S")

Again, anything missed?

Thanks a lot for all of your help.

0 Karma

SplunkTrust
SplunkTrust

Thanks, somesoni2. Answer corrected.

---
If this reply helps you, an upvote would be appreciated.
0 Karma