<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Session Duration in minutes in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Session-Duration-in-minutes/m-p/21139#M3130</link>
    <description>&lt;P&gt;What if you wanted to add days?&lt;/P&gt;</description>
    <pubDate>Tue, 15 Oct 2019 14:18:44 GMT</pubDate>
    <dc:creator>reneedeleon</dc:creator>
    <dc:date>2019-10-15T14:18:44Z</dc:date>
    <item>
      <title>Session Duration in minutes</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Session-Duration-in-minutes/m-p/21135#M3126</link>
      <description>&lt;P&gt;I have a search that returns the "Avg Session Duration" by USER_ID.  The results are coming back in minutes as long as the time being returned is less then 60 minutes. My problem is that when the "Avg Session Duration" goes over 1 hour the minutes no longer return properly.&lt;/P&gt;

&lt;P&gt;This is my format, at the end of my search string, to have the response time come back in minutes.&lt;BR /&gt;&lt;BR /&gt;
&amp;lt; mysearch &amp;gt; | fieldformat "Avg Session Duration(minutes)"=strftime('Avg Session Duration(minutes)', "%M:%S")&lt;/P&gt;

&lt;P&gt;I have tried to add %H and make the time format "%H:%M:%S" but the "Avg Session Duration" is still being returned wrong.  Is there a way to return the "Avg Session Duration" in an hour, min, second format?  &lt;/P&gt;</description>
      <pubDate>Wed, 31 Jul 2013 19:24:05 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Session-Duration-in-minutes/m-p/21135#M3126</guid>
      <dc:creator>JoeSco27</dc:creator>
      <dc:date>2013-07-31T19:24:05Z</dc:date>
    </item>
    <item>
      <title>Re: Session Duration in minutes</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Session-Duration-in-minutes/m-p/21136#M3127</link>
      <description>&lt;P&gt;please provide example of how the minute field in the events look before 1 minute and after 1 minute&lt;/P&gt;</description>
      <pubDate>Wed, 31 Jul 2013 19:49:10 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Session-Duration-in-minutes/m-p/21136#M3127</guid>
      <dc:creator>cramasta</dc:creator>
      <dc:date>2013-07-31T19:49:10Z</dc:date>
    </item>
    <item>
      <title>Re: Session Duration in minutes</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Session-Duration-in-minutes/m-p/21137#M3128</link>
      <description>&lt;P&gt;This will likely do what you are looking for:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;rename "Avg Session Duration(minutes)" AS avgSessionDuration 
| fieldformat avgSessionDuration=tostring(avgSessionDuration,"duration") 
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;&lt;IMG src="http://splunk-base.splunk.com//storage/Untitled1008_1.png" alt="alt text" /&gt;&lt;/P&gt;

&lt;P&gt;This has also been hacked in the past to make even prettier:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;rename "Avg Session Duration(minutes)" AS avgSessionDuration 
| eval pretty_AvgSessionDuration = floor(avgSessionDuration/60)." Hours ".floor(floor(avgSessionDuration - (avgSessionDuration/60))/60)." Min"
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;&lt;IMG src="http://splunk-base.splunk.com//storage/Untitled1009.png" alt="alt text" /&gt;&lt;/P&gt;</description>
      <pubDate>Wed, 31 Jul 2013 20:13:54 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Session-Duration-in-minutes/m-p/21137#M3128</guid>
      <dc:creator>Gilberto_Castil</dc:creator>
      <dc:date>2013-07-31T20:13:54Z</dc:date>
    </item>
    <item>
      <title>Re: Session Duration in minutes</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Session-Duration-in-minutes/m-p/21138#M3129</link>
      <description>&lt;P&gt;Thank you, this works perfectly&lt;/P&gt;</description>
      <pubDate>Thu, 01 Aug 2013 13:51:58 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Session-Duration-in-minutes/m-p/21138#M3129</guid>
      <dc:creator>JoeSco27</dc:creator>
      <dc:date>2013-08-01T13:51:58Z</dc:date>
    </item>
    <item>
      <title>Re: Session Duration in minutes</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Session-Duration-in-minutes/m-p/21139#M3130</link>
      <description>&lt;P&gt;What if you wanted to add days?&lt;/P&gt;</description>
      <pubDate>Tue, 15 Oct 2019 14:18:44 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Session-Duration-in-minutes/m-p/21139#M3130</guid>
      <dc:creator>reneedeleon</dc:creator>
      <dc:date>2019-10-15T14:18:44Z</dc:date>
    </item>
  </channel>
</rss>

