How to plot duration on y-axis?

[splunkIT]

I have a simple search like this:

index=main sourcetype=test | table date_mday, Duration

Note: the values for Duration are in time format (hh:mm:ss)

When I create a line chart, nothing appears on the chart.

[Flynt]

Err. You could also do it simply with Convert- Sorry didn't think about this one until I looked at all those evals. dur2sec will also take into account days if they exist in the Duration field.

yoursearch |dedup date_mday|convert dur2sec(Duration) |table date_mday, Duration|eval Duration=round(((Duration)/60),2)|sort + date_mday

[Flynt · Accepted solution]

Duration is a string so this would have to be converted in order to plot correctly.

One way to do this is convert the duration to seconds and then plot from there. For instance if your results return a Duration field (along with date_mday)

yoursearch |dedup date_mday| table Duration, date_mday|rex field=Duration "(?<hour>^.+):(?<min>.+):(?<sec>.+$)"|eval hour=hour*60*60|eval min=min*60|eval Duration=round(((hour+min+sec)/60),2)|table date_mday, Duration|sort + date_mday

This should chart the Duration in minutes (that's where our /60 in the last eval statement comes in) on the y axis over the date_mday on the x axis

[splunkIT]

Yup. @Flynt's suggestion is working for me. You rock, dude 🙂
I did remove the first table command just to tidy up things a bit:

yoursearch |dedup date_mday| rex field=Duration "(?^.+):(?.+):(?.+$)"|eval hour=hour*60*60|eval min=min*60|eval Duration=round(((hour+min+sec)/60),2)|table date_mday, Duration|sort + date_mday

[Flynt]

My second answer is actually cleaner and more effective.