topic Re: How to Add multiple field values for the matching value of another field in Splunk Search

How to Add multiple field values for the matching value of another field

Edwin1471 — Tue, 12 Jul 2022 10:14:08 GMT

I want to create a query, that would combine all the duration values into one by adding them for each Time Date.

The result should look something like this :

Duration | TimeDate

03:59:18 | 2022-07-31

......... | 2022-06-30

........ | 2022-05-30

and so on

Re: How to Add multiple field values for the matching value of another field

ITWhisperer — Tue, 12 Jul 2022 10:27:17 GMT

Were the durations originally in seconds as this would make it easier

| stats sum(duration_in_seconds) as duration_in_seconds by TimeDate | fieldformat duration_in_seconds=tostring(duration_in_seconds,"duration")

Re: How to Add multiple field values for the matching value of another field

Edwin1471 — Tue, 12 Jul 2022 10:39:36 GMT

The initial query

| eval finish_time_epoch = strptime(FINISH_TIME, "%Y-%m-%d %H:%M:%S")
| eval start_time_epoch = strptime(START_TIME, "%Y-%m-%d %H:%M:%S")
| eval duration = tostring((finish_time_epoch - start_time_epoch), "duration")
| rex field="duration" mode=sed "s/\..*$//"
| sort -FINISH_TIME
| table duration, timeDate

Re: How to Add multiple field values for the matching value of another field

ITWhisperer — Tue, 12 Jul 2022 10:47:09 GMT

Try this

| eval finish_time_epoch = strptime(FINISH_TIME, "%Y-%m-%d %H:%M:%S") | eval start_time_epoch = strptime(START_TIME, "%Y-%m-%d %H:%M:%S") | eval duration = finish_time_epoch - start_time_epoch | stats sum(duration) as duration by finish_time_epoch | sort - finish_time_epoch | eval TimeDate=strftime(finish_time_epoch, "%Y-%m-%d %H:%M:%S") | eval duration=tostring(duration,"duration") | table duration TimeDate