Splunk Search

How can I set the y-axis on my bar chart to be in duration?

tamduong16
Contributor

I have the following search:

....| stats sum(callduration) as "totalcallduration" by Companycalls

Currently my search give me the result in second. I'm trying to get this result convert to duration so that I could map it on my bar chart. Is there an option that splunk could map bar chart for duration like excel? I want to get it to look like this:

alt text

0 Karma

jkat54
SplunkTrust
SplunkTrust

Try this:

...| stats sum(callduration) as totalcallduration by Companycalls | eval totalcallduration=tostring(totalcallduration,"duration")
0 Karma

tamduong16
Contributor

This work great but when I select the chart. My chart doesn't display anything.

0 Karma

tamduong16
Contributor

By this I mean the y-axis display number like 0-1000 instead of time. And at the end splunk generate an empty bar chart

0 Karma

jkat54
SplunkTrust
SplunkTrust

Is the totalcallduration field in seconds?

0 Karma

tamduong16
Contributor

YES! Please help

0 Karma

jkat54
SplunkTrust
SplunkTrust

What I gave you worked when I gave it random seconds in the totalcallduration field and it charted it.

0 Karma

tamduong16
Contributor

But this is for data showing purposes, I can not replace the second with just random second. Is there anything else I could do?

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...