Splunk Search

How can I change bar chart interval to time duration?

tamduong16
Contributor

I have the following search:

...| convert dur2sec("Call Duration") as "CDinsec" | stats sum(CDinsec) as "totalCDsec", avg(CDinsec) as "avgCDinsec" by Company

which give me this result:

alt text

How can I change the value from totalCDsec and avgCDinsec (currently in second) to duration so that I could put it in a double column bar chart?

0 Karma

woodcock
Esteemed Legend

To change to duration when displayed (so that all charting functions still work), do this:

| fieldformat totalCDsec=tostring(totalCDsec,"duration")
0 Karma

somesoni2
Revered Legend

YOu can convert using eval-tostring function but once converted to duration (string), you won't be able to plot it in chart (chart series should've numerical values). FYI, the conversion to duration would be like this: | eval totalCDsec=tostring(totalCDsec,"duration")

tamduong16
Contributor

thanks! But do you think I could convert from that tostring to duration?

0 Karma

somesoni2
Revered Legend

You can using the eval syntax I provided. Will work for table visualization.

0 Karma
Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...