Splunk Search
Highlighted

How can I change bar chart interval to time duration?

Contributor

I have the following search:

...| convert dur2sec("Call Duration") as "CDinsec" | stats sum(CDinsec) as "totalCDsec", avg(CDinsec) as "avgCDinsec" by Company

which give me this result:

alt text

How can I change the value from totalCDsec and avgCDinsec (currently in second) to duration so that I could put it in a double column bar chart?

0 Karma
Highlighted

Re: How can I change bar chart interval to time duration?

SplunkTrust
SplunkTrust

YOu can convert using eval-tostring function but once converted to duration (string), you won't be able to plot it in chart (chart series should've numerical values). FYI, the conversion to duration would be like this: | eval totalCDsec=tostring(totalCDsec,"duration")

Highlighted

Re: How can I change bar chart interval to time duration?

Contributor

thanks! But do you think I could convert from that tostring to duration?

0 Karma
Highlighted

Re: How can I change bar chart interval to time duration?

SplunkTrust
SplunkTrust

You can using the eval syntax I provided. Will work for table visualization.

0 Karma
Highlighted

Re: How can I change bar chart interval to time duration?

Esteemed Legend

To change to duration when displayed (so that all charting functions still work), do this:

| fieldformat totalCDsec=tostring(totalCDsec,"duration")
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.