All Apps and Add-ons

Cisco ASA Report-Duration in Minutes and not seconds

mgs2012
New Member

I'm trying to get a report out of my Cisco ASA VPN device using the following search report

source=*.log | xmlkv | stats first(Calling-Station-Id) as Calling-Station-Id, first(NAS-IP-Address) as NetworkDeviceName,first(User-Name) as User-Name,last(_time) as Starttime,first(_time) as Endtime,first(Acct-Session-Time) as "DURATION: in-seconds" by Acct-Session-Id |
eval Starttime=strftime(Starttime,"%+") |
eval Endtime=strftime(Endtime,"%+") |
table User-Name Starttime Endtime "DURATION: in-seconds" Calling-Station-Id

What I would like to achieve is to get the duration time in minutes. Does anybody know how to do this?

Please let me know.
Thanks in advance

0 Karma

joshbronko
New Member

This will work for what your trying to do. I converted the output duration to Hours:Minutes:Seconds

source=*.log | xmlkv | stats first(Calling-Station-Id) as Calling-Station-Id, first(NAS-IP-Address) as NetworkDeviceName,first(User-Name) as User-Name,last(_time) as Starttime,first(_time) as Endtime,first(Acct-Session-Time) as DURATION by Acct-Session-Id |
eval Starttime=strftime(Starttime,"%+") |
eval Endtime=strftime(Endtime,"%+") | eval h=floor(DURATION/3600) | eval m=floor((DURATION-(h*3600))/60) | eval s=floor(DURATION-(h*3600)-(m*60)) | eval SessionDuration =h." Hours ".m." Minutes ".s." Seconds" |
table User-Name Starttime Endtime SessionDuration Calling-Station-Id

Works when I email the command. Does not work when i upload it to this post

0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...