https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-average-time-of-day-a-job-will-finish-with/m-p/181255#M52258 <P>Try this!</P> <P>(your search)|eval endtime_epoc=strptime(end_time,"%d/%m/%Y %I:%M:%S %P")|eval date=strftime(endtime_epoc,"%d/%m/%Y")|stats avg(endtime_epoc) as avg_endtime by date|eval avg_endtime=strftime(avg_endtime,"%I:%M:%S %P")|table date,avg_endtime</P> Mon, 28 Sep 2020 17:20:02 GMT HiroshiSatoh 2020-09-28T17:20:02Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-average-time-of-day-a-job-will-finish-with/m-p/181252#M52255 <P>I have a table which has start_time &amp; end_time of some jobs. Now i want to calculate the average at what point of time in a day the job ends.</P> <P>start_time end_time<BR /> 13/03/2014 11:12:29 am 13/03/2014 11:25:23 am<BR /> 13/03/2014 12:02:05 pm 13/03/2014 12:15:29 pm<BR /> 13/03/2014 12:29:00 pm 13/03/2014 12:58:20 pm<BR /> 13/03/2014 01:00:30 pm 13/03/2014 01:12:59 pm</P> <P>My average of end_time should tell me something like daily at "12:10:23 pm" the job will be finished.</P> Mon, 28 Sep 2020 17:19:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-average-time-of-day-a-job-will-finish-with/m-p/181252#M52255 allan_newton 2020-09-28T17:19:59Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-average-time-of-day-a-job-will-finish-with/m-p/181253#M52256 <P>You could append this:</P> <PRE><CODE>... | eval epoch_end = strptime(end_time, "%d/%m/%Y %H:%M:%S") | stats avg(epoch_end) as avg_epoch_end | eval avg_end = strftime(avg_epoch_end, "%d/%m/%Y %H:%M:%S") </CODE></PRE> Thu, 14 Aug 2014 07:23:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-average-time-of-day-a-job-will-finish-with/m-p/181253#M52256 martin_mueller 2014-08-14T07:23:31Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-average-time-of-day-a-job-will-finish-with/m-p/181254#M52257 <P>Send your table output to this:</P> <PRE><CODE>| eval endtime_epoc=strptime(end_time, "%d/%m/%Y %I:%M:%S %p") | eval day_seconds=endtime_epoc%86400 | stats list(start_time) list(end_time) avg(day_seconds) as avg_day_seconds | eval avg_endtime=strftime(avg_day_seconds, "%I:%M:%S %p") </CODE></PRE> Thu, 14 Aug 2014 07:24:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-average-time-of-day-a-job-will-finish-with/m-p/181254#M52257 datasearchninja 2014-08-14T07:24:56Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-average-time-of-day-a-job-will-finish-with/m-p/181255#M52258 <P>Try this!</P> <P>(your search)|eval endtime_epoc=strptime(end_time,"%d/%m/%Y %I:%M:%S %P")|eval date=strftime(endtime_epoc,"%d/%m/%Y")|stats avg(endtime_epoc) as avg_endtime by date|eval avg_endtime=strftime(avg_endtime,"%I:%M:%S %P")|table date,avg_endtime</P> Mon, 28 Sep 2020 17:20:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-average-time-of-day-a-job-will-finish-with/m-p/181255#M52258 HiroshiSatoh 2020-09-28T17:20:02Z