how to convert days,minutes,hours and seconds to just seconds format to obtain the visualization?

[pavanae]

I have a simple lookup query as follows :-

| inputlookup ABC.csv

which gives the result as follows :-

Which doesn't give me any visualization. Now how can I get a "Line Chart" visualization with 3 line patterns like "time-to-close", "time-to-discover" and "time-to-respond"

I assume the current time format for all the 3 columns should be converted to a unique value either by seconds or by minutes inorder to get any visualization like "1 d,0 h, 0 m and 0 s" as "86400s" but I'm not sure how to get the eval logic for that.

Any help would be great.

[poete]

Hi,

what about this?

|  makeresults |  eval Parameter="321 d, 10 h, 48 m and 46 s" |eval ts=strptime(Parameter,"%j d, %H h, %M m and %S s")

ts is what you need

[pavanae]

@poete I have more than 40 rows. The above solution gives me the solution for just row 1 . Here I want to use the lookup table results (40 rows) and then convert them in a new row. Is there any possibility to get the required result.

[renjith_nair · Accepted solution]

Try this and if it works for you, then convert all fields similar to this

    |stats count|eval time_to_close="1 d,0 h, 0 m and 1 s"|eval time_to_close=split(replace(replace(time_to_close," ",":"),",",":"),":")
    |eval time_to_close_sec=tonumber(mvindex(time_to_close,0))*86400+tonumber(mvindex(time_to_close,2))*3600+tonumber(mvindex(time_to_close,5))*60+tonumber(mvindex(time_to_close,8))

[pavanae]

@renjith.nair I have more than 40 rows. The above solution gives me the solution for just row "1 d,0 h, 0 m and 1 s" . Here I want to use the lookup table results (40 rows) and then convert them in a new row. Is there any possibility to get the required result.