Splunk Search

Chart by Duration (D+HH:MM:SS) which is in string format?

deodeshm
Explorer

Hello,

I used below to convert seconds into D+HH:MM:SS format which is now in string format. However, I want to create charts based on duration taken to publish the turn around times.

eval strSecs=tostring(secs,"duration")

 How can I use these strings to create chart or is there any way to convert seconds to HH:MM:SS format which is quantifiable and not a string?

 

Thanks,

Deovrat

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @deodeshm,

No, in general, if you convert a number in a string, it remains a string, you can eventually reconvert into a number.

Could you share your search to see if there's a different approach to use?

Ciao.

Giuseppe

0 Karma

deodeshm
Explorer

Thanks for the answer,  below is the search query, I can plot the chart with seconds but want the label in D+hh:mm:ss format, is there any way?

 

index=<>  | eval month=strftime(_time,"%B %Y") | rename fields.customfield_17410 AS alert_time | eval g_e_time = strptime(gsoc_engagement_time,"%Y-%m-%dT%H:%M:%S") | eval a_time = strptime(alert_time,"%Y-%m-%dT%H:%M:%S") | eval cl_time = strptime(closed_time,"%Y-%m-%dT%H:%M:%S") | eval mtta_diff = g_e_time-a_time | eval mttt_diff = cl_time - a_time | stats avg(mtta_diff) AS MTTA, avg(mttt_diff) AS MTTT by month | eval MTTA=tostring(round(MTTA,0), "duration") | eval MTTT=tostring(round(MTTT,0), "duration")

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @deodeshm,

I am afraid that it is not possible to represent a string in a graph, the only method is to use a table next to the graph to allow a quick reading of the values.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...