Splunk Search

How can I change bar chart interval to time duration?

tamduong16
Contributor

I have the following search:

...| convert dur2sec("Call Duration") as "CDinsec" | stats sum(CDinsec) as "totalCDsec", avg(CDinsec) as "avgCDinsec" by Company

which give me this result:

alt text

How can I change the value from totalCDsec and avgCDinsec (currently in second) to duration so that I could put it in a double column bar chart?

0 Karma

woodcock
Esteemed Legend

To change to duration when displayed (so that all charting functions still work), do this:

| fieldformat totalCDsec=tostring(totalCDsec,"duration")
0 Karma

somesoni2
Revered Legend

YOu can convert using eval-tostring function but once converted to duration (string), you won't be able to plot it in chart (chart series should've numerical values). FYI, the conversion to duration would be like this: | eval totalCDsec=tostring(totalCDsec,"duration")

tamduong16
Contributor

thanks! But do you think I could convert from that tostring to duration?

0 Karma

somesoni2
Revered Legend

You can using the eval syntax I provided. Will work for table visualization.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...