Unable to plot the duration by jobname!!

[chinmay25]

I am using the following query to get the average duration for certain Jobs. I want to have a visualization on a daily basis. However, for some reason I am unable to get a visualization. Below is the part of the query.

| eval AVGDURATION = (CALCEND - START)
| stats avg(AVGDURATION) as AVGDURATION by JOBNAME
| eval AVGDURATION = round(AVGDURATION, 2)
| eval HHMMSS=tostring(AVGDURATION, "duration")
| stats values(HHMMSS) as DURATION by JOBNAME

[richgalloway · Accepted solution]

The problem is you're asking Splunk to plot strings rather than numbers.  You should get a visualization by removing the call to tostring().  The second stats command is not needed, either.

| eval AVGDURATION = (CALCEND - START)
| stats avg(AVGDURATION) as AVGDURATION by JOBNAME
| eval AVGDURATION = round(AVGDURATION, 2)

[chinmay25]

Hi Rich,

Thanks for the reply. I was able to get it. Was just having a brain freeze earlier.

Thanks for the help.