How to draw a Chart with Duration field in HH:MM:SS format.

[nandanthakkar]

I have duration field in seconds. I can draw graph using that field. However, I want graph using duration field in HH:MM:SS format.

I tried below query:

search query | transaction maxevents=-1 Application
| chart sum(duration) as duration over Application | fieldformat duration=tostring( duration , "duration")

I get statistics, but I do not get visualization.

Thank you so much.

[ddrillic]

Oh, | eval field_in_hhmmss=tostring(field_in_secs, "duration") based on How to convert second to HH:MM:SS format in the exported search result?

I just tried | eval field_in_hhmmss=tostring(10000, "duration") and it's good ; - )

[niketn]

@ddrillic, if your problem is resolved, please convert your comment to answer and accept the same to mark this question as answered.

[ddrillic]

@nandanthakkar - please accept if the advice solved your issue...

[nandanthakkar]

I am sorry for delayed response. I do get a field in HHMMSS format in table/ statistics tab using the code that you suggested. However, I am unable to use field_in_hhmmss in visualization. I want duration in visualization in HHMMSS format. I only able to make visualization using duration in seconds. Please help me to put duration in HHMMSS format on visualization

[ddrillic]

What do you have in the field duration to begin with?

[nandanthakkar]

num of seconds in duration field.

[nandanthakkar]

It is decimal.