How to change the search that will convert table format to bar or column chart?

[power12]

Hello Splunkers ,

I have the following search which gives me the the dashboard look as table...but can  we make this as a column or bar chart where each bar is a SN and when hover over shows the duration 

index=abc  
| stats earliest(_time) as etime latest(_time) as ltime by SN 
| eval duration=ltime - etime
| eval time_duration=tostring(duration, "duration")
| fields  SN time_duration

Below is the sample events

2023-03-01T11:14:41.094095-08:00 hostabc log-inventory.sh[22269]: GPU7: PCISLOT: xx.yyy, MODEL: Graphics Device, PN: 2vvv1, BOARDPN: vvv, SN: 155552
2022-03-01T11:14:41.094095-08:00 hostabc log-inventory.sh[22269]: GPU7: PCISLOT: xx.yyy, MODEL: Graphics Device, PN: 2vvv1, BOARDPN: vvv, SN: 155552,

Thanks in Advance

[bowesmana]

If you want the Y-axis to be duration, then it must be numeric, so you can't use tostring. You will have to represent it in whatever time quantifier makes sense, in this case, where the duration is 365 days, so in this example,

| eval duration=ltime - etime
| eval duration=duration/86400
| fields  SN duration

Convert the time to days (divide by 86400) and then show as a bar chart. Your divisor can be 3600 for hours or whatever makes sense given your data.

If you have big differences between durations, then it will make sense to show a log scale Y-axis.

[power12]

@bowesmana Thank you for your reply .But I am trying to see if can we make one ourselves and define our own bins....
For example, if the longest time a SN has been installed is 400 days, and we have xx SN's.  divide 400 days by 20, Then we define the bin, and each bin is 400/20.
xaxis is
Bin 1- 0-20 days
Bin 2 21-40 days
bin 3 41-60 days
blah blah Can we determine how many SN's have been installed for 0-20 days sum it and plot is for bin 1.... Maybe the Y-axis is 5 for bin1 because 5 SN's have been in the there for 0-20 days. etc

Thanks in Advance

[ITWhisperer]

Try something like this

index=abc  
| stats earliest(_time) as etime latest(_time) as ltime by SN 
| eval duration=ltime - etime
| eval duration=duration/86400
| bin duration as days span=20
| chart count by days