https://community.splunk.com/t5/Splunk-Search/how-to-get-average-of-time-field/m-p/136908#M37461 <P>Yes I have! Thank you, the last question about this, trying if you can help me with this last step <span class="lia-unicode-emoji" title=":grinning_face_with_smiling_eyes:">😄</span></P> <P>The output is 00:15:04.502712, is there some way that I can remove the ms and show it as 00:15:04 ?</P> <P>Thank you a lot! </P> Wed, 13 Jan 2016 13:31:30 GMT marina_rovira 2016-01-13T13:31:30Z https://community.splunk.com/t5/Splunk-Search/how-to-get-average-of-time-field/m-p/136902#M37455 <P>I have following values in a field(CPU)</P> <P>000 00:00:00.00</P> <P>000 00:00:00.03</P> <P>000 00:00:43.18</P> <P>000 00:00:20.69</P> <P>000 00:00:00.04</P> <P>000 00:00:00.01</P> <P>000 00:00:00.03</P> <P>I tried the following query to extract</P> <P>...| eval t = strftime(strptime(CPU,"+%Q %H:%M:%S.%N"),"%H:%M:%S.%N") | stats avg(t) by host</P> <P>But unable to get the results</P> <P>And suggestions?</P> <P>Regards</P> <P>Asif J.</P> Mon, 21 Apr 2014 09:22:52 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-average-of-time-field/m-p/136902#M37455 asifhj 2014-04-21T09:22:52Z https://community.splunk.com/t5/Splunk-Search/how-to-get-average-of-time-field/m-p/136903#M37456 <P>Are those values timestamps or durations?</P> Mon, 21 Apr 2014 09:35:14 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-average-of-time-field/m-p/136903#M37456 martin_mueller 2014-04-21T09:35:14Z https://community.splunk.com/t5/Splunk-Search/how-to-get-average-of-time-field/m-p/136904#M37457 <P>Durations?</P> Mon, 21 Apr 2014 10:23:22 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-average-of-time-field/m-p/136904#M37457 asifhj 2014-04-21T10:23:22Z https://community.splunk.com/t5/Splunk-Search/how-to-get-average-of-time-field/m-p/136905#M37458 <P>You can do this to convert your duration strings into seconds:</P> <PRE><CODE>... | eval tmp = replace(replace(duration, "\.\d+$", ""), "\s+", "+") | convert dur2sec(tmp) as converted | fields - tmp | eval converted = converted + tonumber("0.".replace(duration, "^.*\.", "")) </CODE></PRE> <P>There's a bit of format changing required before <CODE>convert dur2sec()</CODE> will accept the string, but it'll work. Once you have the durations in seconds you can do any calculation you want, including <CODE>stats avg(converted)</CODE>.</P> Mon, 21 Apr 2014 11:16:14 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-average-of-time-field/m-p/136905#M37458 martin_mueller 2014-04-21T11:16:14Z https://community.splunk.com/t5/Splunk-Search/how-to-get-average-of-time-field/m-p/136906#M37459 <P>Hi there!</P> <P>I have the same question, but I didn't get your answer. What should be the value of tmp?<BR /> I don't understand either the tonumber function.</P> <P>These are some of the durations I have, the field is called "Time spent" and I would like to calculate the average for a specific search like for especific customer that I've selected before (search customer=X).<BR /> 00:01:00<BR /> 00:02:00<BR /> 00:05:00 <BR /> 00:03:00<BR /> 00:04:00<BR /> 00:06:00<BR /> 00:00:00<BR /> 00:07:00<BR /> (this is how I search for a specific value for this field Tspent="00:01:00", I supouse it is duration)</P> <P>Thanks! </P> Wed, 13 Jan 2016 09:55:55 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-average-of-time-field/m-p/136906#M37459 marina_rovira 2016-01-13T09:55:55Z https://community.splunk.com/t5/Splunk-Search/how-to-get-average-of-time-field/m-p/136907#M37460 <P>You should get the expected result with this </P> <PRE><CODE>... | eval dur = replace(Tspent, "\.\d+$", "") | convert dur2sec(dur) | stats avg(dur) as avgTspent </CODE></PRE> Wed, 13 Jan 2016 13:04:09 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-average-of-time-field/m-p/136907#M37460 sundareshr 2016-01-13T13:04:09Z https://community.splunk.com/t5/Splunk-Search/how-to-get-average-of-time-field/m-p/136908#M37461 <P>Yes I have! Thank you, the last question about this, trying if you can help me with this last step <span class="lia-unicode-emoji" title=":grinning_face_with_smiling_eyes:">😄</span></P> <P>The output is 00:15:04.502712, is there some way that I can remove the ms and show it as 00:15:04 ?</P> <P>Thank you a lot! </P> Wed, 13 Jan 2016 13:31:30 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-average-of-time-field/m-p/136908#M37461 marina_rovira 2016-01-13T13:31:30Z