https://community.splunk.com/t5/Splunk-Search/Search-average-for-time-taken-field/m-p/430604#M123101 <P>Hi rslama,<BR /> This works perfectly! Thank you so much for the help. You guys are awesome!!!</P> Fri, 21 Jun 2019 17:18:50 GMT salles 2019-06-21T17:18:50Z https://community.splunk.com/t5/Splunk-Search/Search-average-for-time-taken-field/m-p/430602#M123099 <P>Hi, I have a log file that has a field called "TimeTaken".<BR /><BR /> The values of this field are in the format:</P> <PRE><CODE>00:01:27.763 00:02:10.15 00:01:36.175 00:00:48.368 00:00:22.692 </CODE></PRE> <P>etc..<BR /> This signifies how long this operation took in HH:MM;SS;ms format (per each log line).<BR /><BR /> I am trying to figure out a way to do calculations on this field, for example, get an Average "timetaken" or how many events took longer than 00:12:00:00 (12 minutes) etc.<BR /><BR /> Is there any way this can be done using a clever Splunk search?<BR /><BR /> Any help would be much appreciated.</P> Thu, 20 Jun 2019 21:24:42 GMT https://community.splunk.com/t5/Splunk-Search/Search-average-for-time-taken-field/m-p/430602#M123099 salles 2019-06-20T21:24:42Z https://community.splunk.com/t5/Splunk-Search/Search-average-for-time-taken-field/m-p/430603#M123100 <P>I think it will be easier if you converted to seconds, then do your average from there...<BR /> *adding /60</P> <P>| eval Hr=(mvindex(split(TimeTaken,":"),0)) <BR /> | eval Hr=Hr*60*60<BR /> | eval Mn=(mvindex(split(TimeTaken,":"),1))<BR /> | eval Mn=Mn*60<BR /> | eval Sc=mvindex(split(TimeTaken,":"),2) <BR /> | eval <STRONG>newTime</STRONG>=(Hr+Mn+Sc)<STRONG>/60</STRONG></P> Wed, 30 Sep 2020 01:01:21 GMT https://community.splunk.com/t5/Splunk-Search/Search-average-for-time-taken-field/m-p/430603#M123100 rslama 2020-09-30T01:01:21Z https://community.splunk.com/t5/Splunk-Search/Search-average-for-time-taken-field/m-p/430604#M123101 <P>Hi rslama,<BR /> This works perfectly! Thank you so much for the help. You guys are awesome!!!</P> Fri, 21 Jun 2019 17:18:50 GMT https://community.splunk.com/t5/Splunk-Search/Search-average-for-time-taken-field/m-p/430604#M123101 salles 2019-06-21T17:18:50Z https://community.splunk.com/t5/Splunk-Search/Search-average-for-time-taken-field/m-p/430605#M123102 <P>glad I was able to help!</P> Fri, 21 Jun 2019 18:22:49 GMT https://community.splunk.com/t5/Splunk-Search/Search-average-for-time-taken-field/m-p/430605#M123102 rslama 2019-06-21T18:22:49Z