I have duration field in seconds. I can draw graph using that field. However, I want graph using duration field in HH:MM:SS format.
I tried below query:
search query | transaction maxevents=-1 Application
| chart sum(duration) as duration over Application | fieldformat duration=tostring( duration , "duration")
I get statistics, but I do not get visualization.
Thank you so much.
| eval field_in_hhmmss=tostring(field_in_secs, "duration") based on How to convert second to HH:MM:SS format in the exported search result?
I just tried
| eval field_in_hhmmss=tostring(10000, "duration") and it's good ; - )
@ddrillic, if your problem is resolved, please convert your comment to answer and accept the same to mark this question as answered.
I am sorry for delayed response. I do get a field in HHMMSS format in table/ statistics tab using the code that you suggested. However, I am unable to use field_in_hhmmss in visualization. I want duration in visualization in HHMMSS format. I only able to make visualization using duration in seconds. Please help me to put duration in HHMMSS format on visualization