I am trying to create a column chart that represents the average session time over a period of time with a 1 day span.
My current search string is:
index= ... | where duration<86400 | timechart span=1d avg(duration) as avg_duration | eval avg_duration=tostring(avg_duration, "duration")
This works to a point. It converts the seconds to a more readable format `dd:hh:mm.000000` by using the `tostring` function, although I am also trying to figure out how to omit the trailing numbers from the values. It then charts them in the statistics tab as expected, however, when I go to the visualization tab and select column chart (or any other visualization for that matter), no data is displayed.
Sample statistics output is below:
_time avg_duration
1 2015-11-01 02:22:06.204878
2 2015-11-02 03:04:41.625000
3 2015-11-03 03:43:17.974903
4 2015-11-04 03:14:31.630522
Then the visualization displays no data. Again, the goal is to remove the numbers after the `.`, then chart the value **avg_duration** by day
I am assuming it is because it is looking for an integer value that I have now converted to a string to make more readable, but I do not want to chart the data in seconds.
Any help would be greatly appreciated.
Thanks,
Kevin
↧