time lost duration format in a join search

[sou128]

I have a simple join search as follow,

index=portal bam="audit" event="userLogout" | stats median(secSessDur) as medDur | eval medDur = round(medDur) | fieldformat medDur = tostring(medDur,"duration") | join [search index=portal bam="audit" event="userLogout" | stats avg(secSessDur) as medDur2 | eval medDur2 = round(medDur2) | fieldformat medDur2 = tostring(medDur2,"duration") ]

it is supposed to rendered in a simpleresultstable like so:

medDur | medDur2
01:20:00 | 00:01:20

but it's rendering medDur2 w/o the duration format like so
medDur | medDur2
01:20:00 | 80

this is happening in both my report and the splunk search form. any help is appreciated. thx

[lguinn2]

Can you do it this way?

index=portal bam="audit" event="userLogout" | 
stats median(secSessDur) as medDur | 
eval medDur = round(medDur) | 
fieldformat medDur = tostring(medDur,"duration") | 
join [search index=portal bam="audit" event="userLogout" | 
stats avg(secSessDur) as medDur2 | 
eval medDur2 = round(medDur2) | fields medDur2 ] |
fieldformat medDur2 = tostring(medDur2,"duration") 

I think this is a kludge, but it might work...