Splunk Search
Highlighted

How can I set the y-axis on my bar chart to be in duration?

Contributor

I have the following search:

....| stats sum(callduration) as "totalcallduration" by Companycalls

Currently my search give me the result in second. I'm trying to get this result convert to duration so that I could map it on my bar chart. Is there an option that splunk could map bar chart for duration like excel? I want to get it to look like this:

alt text

0 Karma
Highlighted

Re: How can I set the y-axis on my bar chart to be in duration?

SplunkTrust
SplunkTrust

Try this:

...| stats sum(callduration) as totalcallduration by Companycalls | eval totalcallduration=tostring(totalcallduration,"duration")
0 Karma
Highlighted

Re: How can I set the y-axis on my bar chart to be in duration?

Contributor

This work great but when I select the chart. My chart doesn't display anything.

0 Karma
Highlighted

Re: How can I set the y-axis on my bar chart to be in duration?

Contributor

By this I mean the y-axis display number like 0-1000 instead of time. And at the end splunk generate an empty bar chart

0 Karma
Highlighted

Re: How can I set the y-axis on my bar chart to be in duration?

SplunkTrust
SplunkTrust

Is the totalcallduration field in seconds?

0 Karma
Highlighted

Re: How can I set the y-axis on my bar chart to be in duration?

Contributor

YES! Please help

0 Karma
Highlighted

Re: How can I set the y-axis on my bar chart to be in duration?

SplunkTrust
SplunkTrust

What I gave you worked when I gave it random seconds in the totalcallduration field and it charted it.

0 Karma
Highlighted

Re: How can I set the y-axis on my bar chart to be in duration?

Contributor

But this is for data showing purposes, I can not replace the second with just random second. Is there anything else I could do?

0 Karma