format timechart fields

[stwong]

Hi all,

In a query "...| timechart span=1d sum(duration) as Duration by type ", possible to format the "sum(duration)" in the format of HH:MM:SS and display in both the Statistics and Visualization tab?

Sorry for the newbie question.
Thanks and regards

[richgalloway · Accepted solution]

Try fieldformat.

...| timechart span=1d sum(duration) as Duration by type | fieldformat Duration=strftime(Duration, "%H:%M:%S")

[somesoni2]

I believe you want to use strftime instead of strptime.

[stwong]

Thanks a lot, but seems the output doesn't change after added fieldformat:

...|transaction ...| timechart span=1d sum(duration) as Duration by type | fieldformat Duration=strftime(Duration, "%H:%M:%S")

Did I miss anything?
Thanks again.

Best Regards

[richgalloway]

You didn't miss anything. Perhaps timechart doesn't honor fieldformat settings.

[stwong]

I changed to following and seems to work:

bucket span=1d _time| stats sum(duration) as Duration by type, _time | fieldformat Duration=strftime(Duration, "%H:%M:%S")

Again, anything missed?

Thanks a lot for all of your help.

[richgalloway]

Thanks, somesoni2. Answer corrected.