topic Convert Decimal to Time Format in Splunk Search

Convert Decimal to Time Format

nlisle — Mon, 05 Oct 2020 11:39:22 GMT

Hello,

I currently have the below search will calculates on average how much time is being spent on the alerts that Splunk generates. On average, it has been calculated that 15 minutes would be spent on each alert for investigation etc. Therefore the below search was written.

index="_internal" sourcetype="scheduler" thread_id="AlertNotifier*" alert_actions=email savedsearch_name=*
| stats count
| eval count=count/4

Result example: 14 Results x 15 Minutes = 210 Minutes/3 Hours 30 Minutes. My results are showing as '3.5 Hours. '

How could I change this so my final results will be in the format of '3 Hours 30 Minutes'.

Thanks.

Re: Convert Decimal to Time Format

ITWhisperer — Mon, 05 Oct 2020 11:51:48 GMT

index="_internal" sourcetype="scheduler" thread_id="AlertNotifier*" alert_actions=email savedsearch_name=* | stats count | eval count=count * 15 * 60 | eval count=tostring(count,"duration")

Re: Convert Decimal to Time Format

gcusello — Mon, 05 Oct 2020 11:54:18 GMT

Hi @nlisle,

you can use the tostring function (with the "duration" option) in the eval command, something like this:

| eval count=tostring(count,"duration")

Ciao.

Giuseppe