Dashboards & Visualizations

How can I display a bar chart with human readable value of duration

Ananya_23
Loves-to-Learn Lots

I'm able to calculate the time difference between the start and end time of my job. I want to display the string value in bar chart how to achieve this.
index=music Job=*
| eval Duration=(end-start_time)
| chart values(Duration) as Duration by "Start Time"

Labels (2)
Tags (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The simple answer is that you can't or at least not easily with standard charts. The x-axis on a bar chart or y-axis on a column chart is numeric and doesn't show strings (which is what you seem to be trying to show your duration as).

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please share some raw anonymised sample events in a code block using the </> button so we can see what you are dealing with.

0 Karma

Ananya_23
Loves-to-Learn Lots


Didnt get u but This is the query which i built up so far which is capturing time difference in HH:MM:SS in stats view but i want to display the same duration in chart as well

index=music Job=*
| stats values(host) as Host values(Job) as Job, earliest(_time) as start_time latest(_time) as end values(x) as "File Name" by oid
| eval Duration=(end-start_time)
| eval end = strftime(end,"%m-%d-%Y %H:%M:%S")
| eval start_time = strftime(start_time,"%m-%d-%Y %H:%M:%S")
| rename opid as OPID, start_time as "Start Time", end as "End Time"
| chart list(Duration) as Duration by "Start Time"
| fieldformat Duration=tostring(round(Duration, 0), "Duration")

Ananya_23_0-1739781260651.png

 



0 Karma

livehybrid
SplunkTrust
SplunkTrust

Is Job unique for each start/end? 
If so I would suggest something like this:

index=music Job=*
| stats earliest(_time) as start_time, latest(_time) as end_time by Job
| eval Duration=(end_time-start_time)
``` The rest of your SPL here, such as ```
| chart values(Duration) as Duration by start_time

 

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

0 Karma

Ananya_23
Loves-to-Learn Lots

There are multiple job with each having unique start and end time

0 Karma

livehybrid
SplunkTrust
SplunkTrust

Ah, is there anything unique in a pair of events to split it by? Oh anything on the event to show is the start or end?

Please could you share some anonymised sample events for us to look at in order to help further?

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

0 Karma

Ananya_23
Loves-to-Learn Lots

 

Didnt get u but This is the query which i built up so far which is capturing time difference in HH:MM:SS in stats view but i want to display the same duration in chart as well

index=music Job=*
| stats values(host) as Host values(Job) as Job, earliest(_time) as start_time latest(_time) as end values(x) as "File Name" by oid
| eval Duration=(end-start_time)
| eval end = strftime(end,"%m-%d-%Y %H:%M:%S")
| eval start_time = strftime(start_time,"%m-%d-%Y %H:%M:%S")
| rename opid as OPID, start_time as "Start Time", end as "End Time"
| chart list(Duration) as Duration by "Start Time"
| fieldformat Duration=tostring(round(Duration, 0), "Duration")

Current stats output: 

Ananya_23_1-1739782356280.png

 



i want to display like this
Ananya_23_0-1739782300558.png

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...