How can I make visualizations with time format hh:mm:ss?

[auaave]

Hi,

I have the below statement with the correct statistics output. However my visualization is empty. But when I use the duration in numbers, it does create charts.

| dedup IDEVENT
| stats sum(DURATION) AS "S_DURATION" BY DESCRIPTION
| eval field_in_hhmmss=tostring(S_DURATION, "duration")
| rename field_in_hhmmss as "DURATION_MIN"
| sort - DURATION_MIN LIMIT=10
| fields - S_DURATION

[DalJeanis]

Normally, when calculated from epoch time, duration would start as a number in seconds rather than minutes. Verify your calculations.

Suggestions:

Calculate the duration in minutes and chart that number.

Calculate the duration in HH:MM:SS format and append that to each DESCRIPTION.

Put an alternate Y axis on the right, called out in hours.

[niketn]

@auaave statistical chart looks for numeric value to be plotted on y-axis. In case you want to plot duration, you should be trying out Timeline Custom Visualization: https://splunkbase.splunk.com/app/3120/