topic Re: Finding Duration and formatting output in Splunk Enterprise

Finding Duration and formatting output

scottmkirkland — Thu, 13 Mar 2025 19:06:26 GMT

I'm having trouble getting my duration into the format I'd prefer... I'd like to see the duration to be MM:SS. However, despite a few different approaches, I keep getting milliseconds.

Re: Finding Duration and formatting output

ITWhisperer — Thu, 13 Mar 2025 20:57:52 GMT

Stop parsing the milliseconds from your time values, or convert the resultant time to an integer, or round the times to zero decimal places.

Re: Finding Duration and formatting output

scottmkirkland — Fri, 14 Mar 2025 17:59:27 GMT

@ITWhisperer Are you suggesting I just drop the %N in my strptime?

If I do that, my results don't change.

Re: Finding Duration and formatting output

VatsalJagani — Sun, 16 Mar 2025 08:41:33 GMT

@scottmkirkland- In your latest query you can just drop all millisecond zeros with the help of substr.

Example:

| eval secondsToAtScene = tonumber(substr(secondsToAtScene, 1, len(secondsToAtScene)-7))

This will just remove last 7 characters which will remove milliseconds part from it.

And you can apply this to any fields the same way.

Re: Finding Duration and formatting output

isoutamo — Sun, 16 Mar 2025 10:53:31 GMT

You should use round to seconds before (or inside) tostring function. That just drop ms away.

Re: Finding Duration and formatting output

scottmkirkland — Wed, 19 Mar 2025 15:33:10 GMT

Thank you @VatsalJagani

I took that and I'm trying to get the avg response time for each year. AvgAtScene is in seconds, so I'm trying to get that into the duration. Any suggestions there?

Re: Finding Duration and formatting output

ITWhisperer — Wed, 19 Mar 2025 16:09:26 GMT

| eval AvgResponse=tostring(round(AvgAdScene,0),"duration")