topic Re: How to add time values together in search query? in Splunk Search

How to add time values together in search query?

cdgill — Tue, 30 Jan 2018 14:05:23 GMT

Basically just trying to add three time values together by doing this: eval total_time = queue_time + Duration + test_summary.duration, but I am not getting any results. Any help?

Re: How to add time values together in search query?

harsmarvania57 — Tue, 30 Jan 2018 15:50:27 GMT

Hi @cdgill,

Can you please provide sample data for all three fields ?

Re: How to add time values together in search query?

niketn — Tue, 30 Jan 2018 16:19:59 GMT

@cdgill, make sure that the three field names are correct and have same case as field names are case sensitive i.e. queue_time, Duration and test_summary.duration.

Since dot (.) is used as string concatenation character for eval, you would need to escape the dot character present in the field name using single quotes in eval expression.

<YourBaseSearchWithThreeFields>
| eval total_time = queue_time + Duration + 'test_summary.duration'

Following is a run anywhere example for the same:

| makeresults
| eval queue_time=5, Duration=4, test_summary.duration=7
| table queue_time Duration "test_summary.duration"
| eval total_time = queue_time + Duration + 'test_summary.duration'

Re: How to add time values together in search query?

cdgill — Tue, 30 Jan 2018 18:45:04 GMT

Just attempted your solution and it seemed to just perform a string concatenation.

Re: How to add time values together in search query?

ssadanala1 — Tue, 29 Sep 2020 17:55:52 GMT

Here you go

Re: How to add time values together in search query?

niketn — Tue, 30 Jan 2018 20:01:14 GMT

@cdgill, have you tried the run anywhere search above? Are you not getting the total_time as 16?

If run anywhere search is working and | eval total_time = queue_time + Duration + 'test_summary.duration' is not working in your current search please add some sample data for the three fields and also mention the field names as is.

What happens when you print | table queue_time Duration "test_summary.duration". Are the fields showing values correctly?

Re: How to add time values together in search query?

cdgill — Tue, 30 Jan 2018 20:04:44 GMT

Here's an image which shows my table along with my search query. I appreciate the help, I'm very new and lost when it comes to Splunk! https://imgur.com/a/FfM0Q

Re: How to add time values together in search query?

ssadanala1 — Tue, 30 Jan 2018 20:11:18 GMT

@cdgill you need to convert the duration to epoch and later change it to human readable format