Dashboards & Visualizations

How to convert time duration in minutes?

aditsss
Motivator

Hi Team,

Currently I am using below query to show duration:

index="abc*" sourcetype=600000304_gg_abs_ipc2 | rex "\[(?<thread>Thread[^\]]+)\]"
| transaction thread startswith=" Started ASSOCIATION process for" endswith="Successfully completed ASSOCIATION process"
| timechart avg(duration) as duration span=1d
| eval duration=tostring(duration, "duration")|sort _time

I am getting output as below:

NewPicture.PNG

I want to see duration in minutes only  Can someone guide me.

Labels (3)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Duration is in seconds so divide by 60 to get minutes.

index="abc*" sourcetype=600000304_gg_abs_ipc2 | rex "\[(?<thread>Thread[^\]]+)\]"
| transaction thread startswith=" Started ASSOCIATION process for" endswith="Successfully completed ASSOCIATION process"
| timechart avg(duration) as duration span=1d
| eval duration=floor(duration/60)|sort _time

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Duration is in seconds so divide by 60 to get minutes.

index="abc*" sourcetype=600000304_gg_abs_ipc2 | rex "\[(?<thread>Thread[^\]]+)\]"
| transaction thread startswith=" Started ASSOCIATION process for" endswith="Successfully completed ASSOCIATION process"
| timechart avg(duration) as duration span=1d
| eval duration=floor(duration/60)|sort _time
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...