Getting Data In

Session Duration in minutes

JoeSco27
Communicator

I have a search that returns the "Avg Session Duration" by USER_ID. The results are coming back in minutes as long as the time being returned is less then 60 minutes. My problem is that when the "Avg Session Duration" goes over 1 hour the minutes no longer return properly.

This is my format, at the end of my search string, to have the response time come back in minutes.

< mysearch > | fieldformat "Avg Session Duration(minutes)"=strftime('Avg Session Duration(minutes)', "%M:%S")

I have tried to add %H and make the time format "%H:%M:%S" but the "Avg Session Duration" is still being returned wrong. Is there a way to return the "Avg Session Duration" in an hour, min, second format?

0 Karma
1 Solution

Gilberto_Castil
Splunk Employee
Splunk Employee

This will likely do what you are looking for:

rename "Avg Session Duration(minutes)" AS avgSessionDuration 
| fieldformat avgSessionDuration=tostring(avgSessionDuration,"duration") 

alt text

This has also been hacked in the past to make even prettier:

rename "Avg Session Duration(minutes)" AS avgSessionDuration 
| eval pretty_AvgSessionDuration = floor(avgSessionDuration/60)." Hours ".floor(floor(avgSessionDuration - (avgSessionDuration/60))/60)." Min"

alt text

View solution in original post

Gilberto_Castil
Splunk Employee
Splunk Employee

This will likely do what you are looking for:

rename "Avg Session Duration(minutes)" AS avgSessionDuration 
| fieldformat avgSessionDuration=tostring(avgSessionDuration,"duration") 

alt text

This has also been hacked in the past to make even prettier:

rename "Avg Session Duration(minutes)" AS avgSessionDuration 
| eval pretty_AvgSessionDuration = floor(avgSessionDuration/60)." Hours ".floor(floor(avgSessionDuration - (avgSessionDuration/60))/60)." Min"

alt text

JoeSco27
Communicator

Thank you, this works perfectly

0 Karma

reneedeleon
Engager

What if you wanted to add days?

0 Karma

cramasta
Builder

please provide example of how the minute field in the events look before 1 minute and after 1 minute

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...