Splunk Search

How to convert time duration in minutes?

ramkyreddy
Explorer

ramkyreddy_0-1691497198124.png

I want convert minutes like (1.78,1.80,1.84,1.95) to (1h:44m,1h.55m,1h.44m,1h.58m)

for example we have 1 hour 95 minutes, but i want   1 hour 58 minutes

This my query
| stats count(eval(status="FAIL")) as fail_count,  sum(duration) as hours by ww,kit,endtime
| eval hours = round(((hours/60)/60),2)
| eval hours=round(sum(hours),2)

Could you please help out this

Labels (1)
Tags (1)
0 Karma

ramkyreddy
Explorer

After removing the seconds from my query, I tried with below query
| stats count(eval(status="FAIL")) as fail_count, sum(duration) as hours by ww, kit, endtime
| eval hours=tostring(hours,"duration")

I got the output like this 

ramkyreddy_0-1691578982939.png

But i want to sum up all the values, i tried with this command not getting  any values
| eval hours=round(sum(hours),2)

ramkyreddy_1-1691579275018.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Not clear what you mean about removing seconds as they still appear to be in your durations.

What sum are you trying to perform as this would normally be used as an aggregate function to a stats command, not an eval command

0 Karma

ramkyreddy
Explorer

After using this command for a duration the values are split in the 1st pick, so I want to sum all the duration values into a single line like in pick 2
| stats count(eval(status="FAIL")) as fail_count, sum(duration) as hours by ww, kit, endtime
| eval hours=tostring(hours,"duration")

ramkyreddy_1-1691591722395.png  

ramkyreddy_2-1691591884231.png

 

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Neither of these pictures relate to the search query you say you are using so I am not sure how to advise you further

0 Karma

ramkyreddy
Explorer

yes, this picture is related to query 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

How are they related? One has a field called hours and the picture has a field called Duration_in_Hrs. One looks like it produces single value fields and the other appears to produce multi-value fields.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

 

| stats count(eval(status="FAIL")) as fail_count,  sum(duration) as hours by ww,kit,endtime
| eval hours=tostring(hours,"duration")

 

Admittedly, this will give you HH:MM:SS but you could remove the seconds from hours beforehand if you need to

Get Updates on the Splunk Community!

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Dashboard Challenge and Watch the .conf24 Global Broadcast!

The Splunk Community Dashboard Challenge is still happening, and it's not too late to enter for the week of ...