Splunk Search
Highlighted

How to draw a Chart with Duration field in HH:MM:SS format.

New Member

I have duration field in seconds. I can draw graph using that field. However, I want graph using duration field in HH:MM:SS format.

I tried below query:

search query | transaction maxevents=-1 Application
| chart sum(duration) as duration over Application | fieldformat duration=tostring( duration , "duration")

I get statistics, but I do not get visualization.

Thank you so much.

0 Karma
Highlighted

Re: How to draw a Chart with Duration field in HH:MM:SS format.

Ultra Champion

What do you have in the field duration to begin with?

0 Karma
Highlighted

Re: How to draw a Chart with Duration field in HH:MM:SS format.

New Member

num of seconds in duration field.

0 Karma
Highlighted

Re: How to draw a Chart with Duration field in HH:MM:SS format.

New Member

It is decimal.

0 Karma
Highlighted

Re: How to draw a Chart with Duration field in HH:MM:SS format.

Ultra Champion

Oh, | eval field_in_hhmmss=tostring(field_in_secs, "duration") based on How to convert second to HH:MM:SS format in the exported search result?

I just tried | eval field_in_hhmmss=tostring(10000, "duration") and it's good ; - )

0 Karma
Highlighted

Re: How to draw a Chart with Duration field in HH:MM:SS format.

Legend

@ddrillic, if your problem is resolved, please convert your comment to answer and accept the same to mark this question as answered.

0 Karma
Highlighted

Re: How to draw a Chart with Duration field in HH:MM:SS format.

Ultra Champion

@nandanthakkar - please accept if the advice solved your issue...

0 Karma
Highlighted

Re: How to draw a Chart with Duration field in HH:MM:SS format.

New Member

I am sorry for delayed response. I do get a field in HHMMSS format in table/ statistics tab using the code that you suggested. However, I am unable to use fieldinhhmmss in visualization. I want duration in visualization in HHMMSS format. I only able to make visualization using duration in seconds. Please help me to put duration in HHMMSS format on visualization

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.