Hi all,
In a query "...| timechart span=1d sum(duration) as Duration by type ", possible to format the "sum(duration)" in the format of HH:MM:SS and display in both the Statistics and Visualization tab?
Sorry for the newbie question.
Thanks and regards
Try fieldformat
.
...| timechart span=1d sum(duration) as Duration by type | fieldformat Duration=strftime(Duration, "%H:%M:%S")
Try fieldformat
.
...| timechart span=1d sum(duration) as Duration by type | fieldformat Duration=strftime(Duration, "%H:%M:%S")
I believe you want to use strftime instead of strptime.
Thanks a lot, but seems the output doesn't change after added fieldformat:
...|transaction ...| timechart span=1d sum(duration) as Duration by type | fieldformat Duration=strftime(Duration, "%H:%M:%S")
Did I miss anything?
Thanks again.
Best Regards
You didn't miss anything. Perhaps timechart
doesn't honor fieldformat settings.
I changed to following and seems to work:
bucket span=1d _time| stats sum(duration) as Duration by type, _time | fieldformat Duration=strftime(Duration, "%H:%M:%S")
Again, anything missed?
Thanks a lot for all of your help.
Thanks, somesoni2. Answer corrected.