We are currently running Splunk Enterprise 6.3.1 on RHEL 6.x servers. I have a string value that I have brought in from a long that represents hours, minutes, and seconds in the form
HH:mm:ss, and the user would like to graph the trend of the duration. The easiest way that I can think of to do this would be to convert this string into a number of seconds so that I could represent a single numeric value to graph. Does anyone have an easy way to do this, or an alternate way to graph
HH:mm:ss? Thanks, in advance for any help you may be able to provide.
Okay, now for a follow up. Is there a way to graph the duration in it's HH:mm:ss format? The end user doesn't like the idea of showing her management the duration in total seconds as she feels management will be confused. I know this is a long shot, but if it was 01:15:30 (i.e. one hour, fifteen minutes and 30 seconds), she would like the graph to be numbered somehow as 1:15:30 and not 4530 seconds.
I think the way to go will be convert this to seconds and chart it. The value should be numerical to be charted so string formatted duration wouldn't work. Something like this should work.
your base search | eval yourDurationField=strptime("01/01/2016 ".yourDurationField,"%m/%d/%Y %H:%M:%S") - strptime("01/01/2016 ","%m/%d/%Y") | your chart command...