https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-figure-out-average-time-tracking/m-p/316963#M94830 <P>That's alright, you're new and sometimes it's the easiest thing that's the hardest to see!</P> Thu, 25 May 2017 12:40:12 GMT cmerriman 2017-05-25T12:40:12Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-figure-out-average-time-tracking/m-p/316960#M94827 <P>Alright...new to Splunk and actually been figuring it out as I go along. The only problem I am having is I am trying to capture 2 time fields. I'm trying to capture Time_To_Own_Minutes and Time_To_Close_Minutes both are avg. The search I have pasted below shows an additional field of overall time that I don't need. Thoughts on how to capture time in minutes?</P> <PRE><CODE>index="alerts" USER_LOGIN=* DUPLICATE_COUNT=0 | rename RECEIVED_TIME as RT, ANNOTATION_TIME as AT, ALERT_OWNERSHIP_TIME as AOT | eval CT=coalesce(CLOSED_TIME, closed_time) | eval Annotes=substr(ANNOTATION,1,3) | eval ctime=strptime(CT, "%m/%d/%y %H:%M:%S") | eval rtime=strptime(RT, "%m/%d/%y %H:%M:%S") | eval atime=strptime(AT, "%m/%d/%y %H:%M:%S") | eval aotime=strptime(AOT, "%m/%d/%y %H:%M:%S") | eval TimeToClose=ctime-rtime | eval TimeToClose=abs(TimeToClose) | eval TimeToOwn=aotime-rtime | eval TimeToOwn=abs(TimeToOwn) | eval RT_Time=strftime(rtime, "%m/%d/%Y %I:%M:%S %p") | eval CT_Time=strftime(ctime, "%m/%d/%Y %I:%M:%S %p") | eval AT_Time=strftime(atime, "%m/%d/%Y %I:%M:%S %p") | eval AOT_Time=strftime(aotime, "%m/%d/%Y %I:%M:%S %p") | eval Time_To_Close_Minutes=round(TimeToClose/60,2) | eval Time_To_Own_Minutes=round(TimeToOwn/60,2) | stats count as "Overall Time" avg(Time_To_Own_Minutes) as "Overall: Avg Time to Close in Minutes" avg(Time_To_Close_Minutes) </CODE></PRE> Tue, 29 Sep 2020 14:14:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-figure-out-average-time-tracking/m-p/316960#M94827 rickyrivera1 2020-09-29T14:14:48Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-figure-out-average-time-tracking/m-p/316961#M94828 <P>if i understand what you're trying to achieve, does this work:</P> <PRE><CODE>index="alerts" USER_LOGIN=* DUPLICATE_COUNT=0 | rename RECEIVED_TIME as RT, ANNOTATION_TIME as AT, ALERT_OWNERSHIP_TIME as AOT | eval CT=coalesce(CLOSED_TIME, closed_time) | eval Annotes=substr(ANNOTATION,1,3) | eval ctime=strptime(CT, "%m/%d/%y %H:%M:%S") | eval rtime=strptime(RT, "%m/%d/%y %H:%M:%S") | eval atime=strptime(AT, "%m/%d/%y %H:%M:%S") | eval aotime=strptime(AOT, "%m/%d/%y %H:%M:%S") | eval Time_To_Close_Minutes=round(abs(ctime-rtime)/60,2) | eval Time_To_Own_Minutes=round(abs(aotime-rtime)/60,2) | stats avg(Time_To_Own_Minutes) as "Overall: Avg Time to Own in Minutes" avg(Time_To_Close_Minutes) as "Overall: Avg Time to Close in Minutes" </CODE></PRE> Wed, 24 May 2017 20:00:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-figure-out-average-time-tracking/m-p/316961#M94828 cmerriman 2017-05-24T20:00:06Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-figure-out-average-time-tracking/m-p/316962#M94829 <P>This is exactly what I was looking for! Sadly for me the change was way too easy, but thank you for your help on this one!!!</P> Thu, 25 May 2017 12:37:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-figure-out-average-time-tracking/m-p/316962#M94829 rickyrivera1 2017-05-25T12:37:19Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-figure-out-average-time-tracking/m-p/316963#M94830 <P>That's alright, you're new and sometimes it's the easiest thing that's the hardest to see!</P> Thu, 25 May 2017 12:40:12 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-figure-out-average-time-tracking/m-p/316963#M94830 cmerriman 2017-05-25T12:40:12Z