I have race data for a regular monthly race, where race time is given as elapsed time in the format MM:SS, e.g. 42:56
I am trying to chart a person's performance each month with
timechart max(RaceTime)
However, the Y-axis shows the race time in seconds. I have been trying to get the Y axis in minutes, but it's not clear what's going on.
Splunk tells me that my RaceTime field isnum(RaceTime) is false,
Using | eval RT=tostring(RaceTime, "duration") does not give me any plots on the chart as RT is null because RaceTime is a string already.
I tried this.
| rex field=RaceTime "(?[0-9]*):(?[0-9]*)"
| eval Duration=Minutes*60+Seconds
| eval f=tostring(Duration, "duration")
| timechart max(f)
Using max(Duration) and max(f) show the same chart, i.e. with seconds, although the field f has the event values like 00:42:56.
↧