Archive

Eval total duration in minutes

lavster
New Member

i've created a table from a project run that displays the time a run started, ended and what time files have been created during the run.

However Im trying to do an eval to get the Total Duration in Minutes for each service which is

Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi lavster,
I suggest to use a different approach to this kind of searches:

  • at first stop to think to Splunk as a database!
  • then don't use join because it's a very slow command!
  • in addition, remember that there's the limit of 50,000 results for subsearches, so you cannot be sure to have all the results in subsearches used in joins;
  • don't use fields with spaces (e.g. "ESLA File Start"), if you want, you can rename fields at the end of the search

So you should try to build something like this one:

index=esla OR index=mule-new (State=START OR State=END) Service="Early SLA"
| bucket _time span=1d as Day 
| eval "ESLA File Start"=if(State="START",FileTime,""),"ESLA File End"=if(State="END",FileTime,""), Day=strftime(Day,"%d/%m/%Y")
| stats earliest(_time) as ESLA_Start latest(_time) as ESLA_End values( "ESLA File Start") AS  "ESLA File Start" values( "ESLA File End") AS  "ESLA File End" by Day
| eval st=strptime(ESLA_Start,"%H:%M:%S"), et=strptime("ESLA File End","%H:%M:%S"), diff=et-st, "ESLA_Total" = tostring(diff, "duration")
| table Day ESLA_Start ESLA_End "ESLA File Start" "ESLA File End" "ESLA_Total"

I cannot test it but the approach should be correct.

Bye.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi lavster,
I suggest to use a different approach to this kind of searches:

  • at first stop to think to Splunk as a database!
  • then don't use join because it's a very slow command!
  • in addition, remember that there's the limit of 50,000 results for subsearches, so you cannot be sure to have all the results in subsearches used in joins;
  • don't use fields with spaces (e.g. "ESLA File Start"), if you want, you can rename fields at the end of the search

So you should try to build something like this one:

index=esla OR index=mule-new (State=START OR State=END) Service="Early SLA"
| bucket _time span=1d as Day 
| eval "ESLA File Start"=if(State="START",FileTime,""),"ESLA File End"=if(State="END",FileTime,""), Day=strftime(Day,"%d/%m/%Y")
| stats earliest(_time) as ESLA_Start latest(_time) as ESLA_End values( "ESLA File Start") AS  "ESLA File Start" values( "ESLA File End") AS  "ESLA File End" by Day
| eval st=strptime(ESLA_Start,"%H:%M:%S"), et=strptime("ESLA File End","%H:%M:%S"), diff=et-st, "ESLA_Total" = tostring(diff, "duration")
| table Day ESLA_Start ESLA_End "ESLA File Start" "ESLA File End" "ESLA_Total"

I cannot test it but the approach should be correct.

Bye.
Giuseppe

View solution in original post

0 Karma

lavster
New Member

Thank you, i'll give this a go.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!