Splunk Search
Highlighted

How to draw a Chart with Duration field in HH:MM:SS format.

New Member

I have duration field in seconds. I can draw graph using that field. However, I want graph using duration field in HH:MM:SS format.

I tried below query:

search query | transaction maxevents=-1 Application
| chart sum(duration) as duration over Application | fieldformat duration=tostring( duration , "duration")

I get statistics, but I do not get visualization.

Thank you so much.

0 Karma
Highlighted

Re: How to draw a Chart with Duration field in HH:MM:SS format.

Ultra Champion

What do you have in the field duration to begin with?

0 Karma
Highlighted

Re: How to draw a Chart with Duration field in HH:MM:SS format.

New Member

num of seconds in duration field.

0 Karma
Highlighted

Re: How to draw a Chart with Duration field in HH:MM:SS format.

New Member

It is decimal.

0 Karma
Highlighted

Re: How to draw a Chart with Duration field in HH:MM:SS format.

Ultra Champion

Oh, | eval field_in_hhmmss=tostring(field_in_secs, "duration") based on How to convert second to HH:MM:SS format in the exported search result?

I just tried | eval field_in_hhmmss=tostring(10000, "duration") and it's good ; - )

0 Karma
Highlighted

Re: How to draw a Chart with Duration field in HH:MM:SS format.

Legend

@ddrillic, if your problem is resolved, please convert your comment to answer and accept the same to mark this question as answered.

0 Karma
Highlighted

Re: How to draw a Chart with Duration field in HH:MM:SS format.

Ultra Champion

@nandanthakkar - please accept if the advice solved your issue...

0 Karma
Highlighted

Re: How to draw a Chart with Duration field in HH:MM:SS format.

New Member

I am sorry for delayed response. I do get a field in HHMMSS format in table/ statistics tab using the code that you suggested. However, I am unable to use fieldinhhmmss in visualization. I want duration in visualization in HHMMSS format. I only able to make visualization using duration in seconds. Please help me to put duration in HHMMSS format on visualization

0 Karma