Dashboards & Visualizations

How can I display a bar chart with human readable value of duration

Ananya_23
Loves-to-Learn Lots

I'm able to calculate the time difference between the start and end time of my job. I want to display the string value in bar chart how to achieve this.
index=music Job=*
| eval Duration=(end-start_time)
| chart values(Duration) as Duration by "Start Time"

Labels (2)
Tags (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The simple answer is that you can't or at least not easily with standard charts. The x-axis on a bar chart or y-axis on a column chart is numeric and doesn't show strings (which is what you seem to be trying to show your duration as).

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please share some raw anonymised sample events in a code block using the </> button so we can see what you are dealing with.

0 Karma

Ananya_23
Loves-to-Learn Lots


Didnt get u but This is the query which i built up so far which is capturing time difference in HH:MM:SS in stats view but i want to display the same duration in chart as well

index=music Job=*
| stats values(host) as Host values(Job) as Job, earliest(_time) as start_time latest(_time) as end values(x) as "File Name" by oid
| eval Duration=(end-start_time)
| eval end = strftime(end,"%m-%d-%Y %H:%M:%S")
| eval start_time = strftime(start_time,"%m-%d-%Y %H:%M:%S")
| rename opid as OPID, start_time as "Start Time", end as "End Time"
| chart list(Duration) as Duration by "Start Time"
| fieldformat Duration=tostring(round(Duration, 0), "Duration")

Ananya_23_0-1739781260651.png

 



0 Karma

livehybrid
Super Champion

Is Job unique for each start/end? 
If so I would suggest something like this:

index=music Job=*
| stats earliest(_time) as start_time, latest(_time) as end_time by Job
| eval Duration=(end_time-start_time)
``` The rest of your SPL here, such as ```
| chart values(Duration) as Duration by start_time

 

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

0 Karma

Ananya_23
Loves-to-Learn Lots

There are multiple job with each having unique start and end time

0 Karma

livehybrid
Super Champion

Ah, is there anything unique in a pair of events to split it by? Oh anything on the event to show is the start or end?

Please could you share some anonymised sample events for us to look at in order to help further?

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

0 Karma

Ananya_23
Loves-to-Learn Lots

 

Didnt get u but This is the query which i built up so far which is capturing time difference in HH:MM:SS in stats view but i want to display the same duration in chart as well

index=music Job=*
| stats values(host) as Host values(Job) as Job, earliest(_time) as start_time latest(_time) as end values(x) as "File Name" by oid
| eval Duration=(end-start_time)
| eval end = strftime(end,"%m-%d-%Y %H:%M:%S")
| eval start_time = strftime(start_time,"%m-%d-%Y %H:%M:%S")
| rename opid as OPID, start_time as "Start Time", end as "End Time"
| chart list(Duration) as Duration by "Start Time"
| fieldformat Duration=tostring(round(Duration, 0), "Duration")

Current stats output: 

Ananya_23_1-1739782356280.png

 



i want to display like this
Ananya_23_0-1739782300558.png

0 Karma
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...