I am trying to create a column chart that represents the average session time over a period of time with a 1 day span.
My current search string is:
index= ... | where duration<86400 | timechart span=1d avg(duration) as avg_duration | eval avg_duration=tostring(avg_duration, "duration")
This works to a point. It converts the seconds to a more readable format dd:hh:mm.000000 by using the tostring function, although I am also trying to figure out how to omit the trailing numbers from the values. It then charts them in the statistics tab as expected, however, when I go to the visualization tab and select column chart (or any other visualization for that matter), no data is displayed.
Sorry, I posted by follow up question in the wrong spot. Incase it doesn't show up properly, I will repost here.
Your search string fixed the format of avg_duration to remove the "extra" characters at the end of the time. The new results are below:
1 2015-11-01 02:22:06
2 2015-11-02 03:04:41
3 2015-11-03 03:43:17
4 2015-11-04 03:30:13
5 2015-11-05 03:29:03
However, the visualization graph is still not graphing the data. It builds the chart correctly with the correct labels for the x and y axis, but reports the value "0" for the actual data. Basically I want to graph the value of avg_duration over a period of time represented by _time.