Dashboards & Visualizations

How can I display a bar chart with human readable value of duration

Ananya_23
Loves-to-Learn Lots

I'm able to calculate the time difference between the start and end time of my job. I want to display the string value in bar chart how to achieve this.
index=music Job=*
| eval Duration=(end-start_time)
| chart values(Duration) as Duration by "Start Time"

Labels (2)
Tags (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The simple answer is that you can't or at least not easily with standard charts. The x-axis on a bar chart or y-axis on a column chart is numeric and doesn't show strings (which is what you seem to be trying to show your duration as).

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please share some raw anonymised sample events in a code block using the </> button so we can see what you are dealing with.

0 Karma

Ananya_23
Loves-to-Learn Lots


Didnt get u but This is the query which i built up so far which is capturing time difference in HH:MM:SS in stats view but i want to display the same duration in chart as well

index=music Job=*
| stats values(host) as Host values(Job) as Job, earliest(_time) as start_time latest(_time) as end values(x) as "File Name" by oid
| eval Duration=(end-start_time)
| eval end = strftime(end,"%m-%d-%Y %H:%M:%S")
| eval start_time = strftime(start_time,"%m-%d-%Y %H:%M:%S")
| rename opid as OPID, start_time as "Start Time", end as "End Time"
| chart list(Duration) as Duration by "Start Time"
| fieldformat Duration=tostring(round(Duration, 0), "Duration")

Ananya_23_0-1739781260651.png

 



0 Karma

livehybrid
SplunkTrust
SplunkTrust

Is Job unique for each start/end? 
If so I would suggest something like this:

index=music Job=*
| stats earliest(_time) as start_time, latest(_time) as end_time by Job
| eval Duration=(end_time-start_time)
``` The rest of your SPL here, such as ```
| chart values(Duration) as Duration by start_time

 

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

0 Karma

Ananya_23
Loves-to-Learn Lots

There are multiple job with each having unique start and end time

0 Karma

livehybrid
SplunkTrust
SplunkTrust

Ah, is there anything unique in a pair of events to split it by? Oh anything on the event to show is the start or end?

Please could you share some anonymised sample events for us to look at in order to help further?

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

0 Karma

Ananya_23
Loves-to-Learn Lots

 

Didnt get u but This is the query which i built up so far which is capturing time difference in HH:MM:SS in stats view but i want to display the same duration in chart as well

index=music Job=*
| stats values(host) as Host values(Job) as Job, earliest(_time) as start_time latest(_time) as end values(x) as "File Name" by oid
| eval Duration=(end-start_time)
| eval end = strftime(end,"%m-%d-%Y %H:%M:%S")
| eval start_time = strftime(start_time,"%m-%d-%Y %H:%M:%S")
| rename opid as OPID, start_time as "Start Time", end as "End Time"
| chart list(Duration) as Duration by "Start Time"
| fieldformat Duration=tostring(round(Duration, 0), "Duration")

Current stats output: 

Ananya_23_1-1739782356280.png

 



i want to display like this
Ananya_23_0-1739782300558.png

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...