Splunk Search

How can I change bar chart interval to time duration?

tamduong16
Contributor

I have the following search:

...| convert dur2sec("Call Duration") as "CDinsec" | stats sum(CDinsec) as "totalCDsec", avg(CDinsec) as "avgCDinsec" by Company

which give me this result:

alt text

How can I change the value from totalCDsec and avgCDinsec (currently in second) to duration so that I could put it in a double column bar chart?

0 Karma

woodcock
Esteemed Legend

To change to duration when displayed (so that all charting functions still work), do this:

| fieldformat totalCDsec=tostring(totalCDsec,"duration")
0 Karma

somesoni2
SplunkTrust
SplunkTrust

YOu can convert using eval-tostring function but once converted to duration (string), you won't be able to plot it in chart (chart series should've numerical values). FYI, the conversion to duration would be like this: | eval totalCDsec=tostring(totalCDsec,"duration")

tamduong16
Contributor

thanks! But do you think I could convert from that tostring to duration?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

You can using the eval syntax I provided. Will work for table visualization.

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...