https://community.splunk.com/t5/Splunk-Search/How-can-I-create-duplicate-events-by-duration-hours/m-p/529595#M149591 <LI-CODE lang="markup">| makeresults | eval duration_hour=7 | eval other="dummy" | eval times=mvrange(_time, _time+(duration_hour * 60 * 60), "1h") | mvexpand times | eval _time=times</LI-CODE> Mon, 16 Nov 2020 18:32:27 GMT ITWhisperer 2020-11-16T18:32:27Z https://community.splunk.com/t5/Splunk-Search/How-can-I-create-duplicate-events-by-duration-hours/m-p/529570#M149578 <P>Hello experts, I am working on a stats of meetings.&nbsp;<BR /><BR />As the attached photo shows, this meeting lasts for 7 (duration_hour) hours which starts at 8 AM (date_hour). I need to duplicate this event 7 times by adding 1 hour at date_hour with each time.<BR /><BR /></P><P>The final result I want is :</P><TABLE width="317px"><TBODY><TR><TD width="86.4px">date_hour</TD><TD width="149.6px">_time</TD><TD width="80px">The rest fields</TD></TR><TR><TD width="86.4px">8</TD><TD width="149.6px">10/29/2020 8:00</TD><TD width="80px">same</TD></TR><TR><TD width="86.4px">9</TD><TD width="149.6px">10/29/2020 9:00</TD><TD width="80px">same</TD></TR><TR><TD width="86.4px">10</TD><TD width="149.6px">10/29/2020 10:00</TD><TD width="80px">same</TD></TR><TR><TD width="86.4px">11</TD><TD width="149.6px">10/29/2020 11:00</TD><TD width="80px">same</TD></TR><TR><TD width="86.4px">12</TD><TD width="149.6px">10/29/2020 12:00</TD><TD width="80px">same</TD></TR><TR><TD width="86.4px">13</TD><TD width="149.6px">10/29/2020 13:00</TD><TD width="80px">same</TD></TR><TR><TD width="86.4px">14</TD><TD width="149.6px">10/30/2020 14:00</TD><TD width="80px">same</TD></TR></TBODY></TABLE><P>&nbsp;</P><P>Looking forward to your answers, thank you.</P> Mon, 16 Nov 2020 16:28:55 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-create-duplicate-events-by-duration-hours/m-p/529570#M149578 Hanliamadeus 2020-11-16T16:28:55Z https://community.splunk.com/t5/Splunk-Search/How-can-I-create-duplicate-events-by-duration-hours/m-p/529595#M149591 <LI-CODE lang="markup">| makeresults | eval duration_hour=7 | eval other="dummy" | eval times=mvrange(_time, _time+(duration_hour * 60 * 60), "1h") | mvexpand times | eval _time=times</LI-CODE> Mon, 16 Nov 2020 18:32:27 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-create-duplicate-events-by-duration-hours/m-p/529595#M149591 ITWhisperer 2020-11-16T18:32:27Z https://community.splunk.com/t5/Splunk-Search/How-can-I-create-duplicate-events-by-duration-hours/m-p/529601#M149595 <P>It works, thank you very much.</P> Mon, 16 Nov 2020 18:46:57 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-create-duplicate-events-by-duration-hours/m-p/529601#M149595 Hanliamadeus 2020-11-16T18:46:57Z