×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Ask a Question
MarcG
Explorer
Member since: ‎05-05-2023
‎05-10-2023
Community Statistics
Posts 4
Solutions 0
Karma Given 1
Karma Received 0
Member Since ‎05-05-2023
Activity Feed
Topics I've Started
View All

Re: Unable to format chart field.

by in Splunk Search
‎05-10-2023 08:12 AM
‎05-10-2023 08:12 AM
That's also interesting, since the spec for the chart command does say that you can assign the results of the aggregate to a field value using the AS command. However, I did try your suggestion, and after a few tweaks (refining the eval of eventAge to produce an integer instead of a float), the report is now providing the results I wanted. Thank you very much for your help! ... View more

Re: Unable to format chart field.

by in Splunk Search
‎05-09-2023 08:11 AM
‎05-09-2023 08:11 AM
While none of the dates in the actual log entries are null, it is the case that not all events occur on all servers, so there are some chart results that evaluate as null. Interestingly, if I follow the chart block with fillnull value=0 then the empty chart entries are replaced with 0 as expected, but if I use fillnull value=0 eventDuration then they aren't, which leads me to believe that the chart results aren't actually being assigned to the eventDuration field, which would explain why my fieldformat command isn't working. ... View more

Re: Unable to format chart field.

by in Splunk Search
‎05-08-2023 06:14 AM
‎05-08-2023 06:14 AM
toString(<value>, "duration") should format the time as HH:MM:SS, as described here - https://docs.splunk.com/Documentation/Splunk/7.2.1/SearchReference/ConversionFunctions ... View more

Why am I unable to format chart field?

by in Splunk Search
‎05-05-2023 02:57 PM
‎05-05-2023 02:57 PM
I'm attempting to chart a maximum duration by server and event_type, and I'd like to display the duration in HH:MM:SS format rather than a number of seconds. However, fieldformat doesn't seem to be applying the change to the assigned duration field. Is there a way to do this? Here's the command:     index=s3batchtest eventcode Open | extract pairdelim="," kvdelim="=" | eval bDate=strptime(beginDate,"%Y-%m-%d %H:%M:%S") | eval lDate=strptime(lastDate,"%Y-%m-%d %H:%M:%S") | eval eventAge=lDate - bDate | chart max(eventAge) AS eventDuration by server eventCode limit=0 | fieldformat eventDuration=toString(eventDuration, "duration")       ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎05-10-2023 12:19 PM
Karma given to
View All