topic Re: Average between 2 fields D+HH:MM:SS in Splunk Search

Average between 2 fields D+HH:MM:SS

Abarny — Mon, 20 Feb 2017 15:24:32 GMT

Hi,

I try to realize an average enter 2 fields which appear in the form of D+HH:MM:SS so i converted with dur2sec. But the result is 0 i don't understand why. Can you help me to find why ? Thanks you.

Re: Average between 2 fields D+HH:MM:SS

richgalloway — Mon, 20 Feb 2017 16:17:02 GMT

What is field E? Counting a field that doesn't exist will make F=0

Re: Average between 2 fields D+HH:MM:SS

Abarny — Mon, 20 Feb 2017 16:22:56 GMT

This field exist, E is an unique identifier on 1 event

Re: Average between 2 fields D+HH:MM:SS

niketn — Mon, 20 Feb 2017 16:31:58 GMT

Have you validated BBB and AAAA values are different or not?
Can you add few data samples?

Re: Average between 2 fields D+HH:MM:SS

Abarny — Mon, 20 Feb 2017 16:37:10 GMT

Yes they are différents exemple : AAA = 2017-02-18 11:53:05
BBB = 2017-02-18 11:53:14

But no i can't add data sample ..

Re: Average between 2 fields D+HH:MM:SS

somesoni2 — Mon, 20 Feb 2017 16:55:07 GMT

You said that your field values are in format D+HH:MM:SS (string formatted duration) but the sample values above shows that they are timestmap, which one is it? If it's timestamp then your convert dur2sec will fail and return 0/null. If they are timestamp, then give this a try

...your base search
| eval duration=strptime(BBB,"%Y-%m-%d %H:%M:%S")-strptime(AAA,"%Y-%m-%d %H:%M:%S")
|stats sum(duration) as duration dc(E) as F
| eval moyen= duration/F
| fields moyen

Re: Average between 2 fields D+HH:MM:SS

Abarny — Mon, 20 Feb 2017 17:04:42 GMT

Okay ! Thanks for your help !

Re: Average between 2 fields D+HH:MM:SS

woodcock — Mon, 20 Feb 2017 17:07:56 GMT

Try this:

| eval duration=strptime(BBB,"%Y-%m-%d %H:%M:%S") - strptime(AAA,"%Y-%m-%d %H:%M:%S")
|stats savg(duration) AS moyen