Splunk Search

## How to plot duration on y-axis?

Splunk Employee

I have a simple search like this:

```
index=main sourcetype=test | table date_mday, Duration
```

Note: the values for Duration are in time format (hh:mm:ss)

When I create a line chart, nothing appears on the chart.

Tags (4)
1 Solution
Splunk Employee

Duration is a string so this would have to be converted in order to plot correctly.

One way to do this is convert the duration to seconds and then plot from there. For instance if your results return a Duration field (along with date_mday)

``````yoursearch |dedup date_mday| table Duration, date_mday|rex field=Duration "(?<hour>^.+):(?<min>.+):(?<sec>.+\$)"|eval hour=hour*60*60|eval min=min*60|eval Duration=round(((hour+min+sec)/60),2)|table date_mday, Duration|sort + date_mday
``````

This should chart the Duration in minutes (that's where our /60 in the last eval statement comes in) on the y axis over the date_mday on the x axis

Splunk Employee

Err. You could also do it simply with Convert- Sorry didn't think about this one until I looked at all those evals. dur2sec will also take into account days if they exist in the Duration field.

``````yoursearch |dedup date_mday|convert dur2sec(Duration) |table date_mday, Duration|eval Duration=round(((Duration)/60),2)|sort + date_mday
``````
Splunk Employee

Duration is a string so this would have to be converted in order to plot correctly.

One way to do this is convert the duration to seconds and then plot from there. For instance if your results return a Duration field (along with date_mday)

``````yoursearch |dedup date_mday| table Duration, date_mday|rex field=Duration "(?<hour>^.+):(?<min>.+):(?<sec>.+\$)"|eval hour=hour*60*60|eval min=min*60|eval Duration=round(((hour+min+sec)/60),2)|table date_mday, Duration|sort + date_mday
``````

This should chart the Duration in minutes (that's where our /60 in the last eval statement comes in) on the y axis over the date_mday on the x axis

Splunk Employee

Yup. @Flynt's suggestion is working for me. You rock, dude 🙂
I did remove the first table command just to tidy up things a bit:

```
yoursearch |dedup date_mday| rex field=Duration "(?^.+):(?.+):(?.+\$)"|eval hour=hour*60*60|eval min=min*60|eval Duration=round(((hour+min+sec)/60),2)|table date_mday, Duration|sort + date_mday
```

Splunk Employee

My second answer is actually cleaner and more effective.

Get Updates on the Splunk Community!

#### Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

#### Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

#### Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...