Getting Data In

Session Duration in minutes

JoeSco27
Communicator

I have a search that returns the "Avg Session Duration" by USER_ID. The results are coming back in minutes as long as the time being returned is less then 60 minutes. My problem is that when the "Avg Session Duration" goes over 1 hour the minutes no longer return properly.

This is my format, at the end of my search string, to have the response time come back in minutes.

< mysearch > | fieldformat "Avg Session Duration(minutes)"=strftime('Avg Session Duration(minutes)', "%M:%S")

I have tried to add %H and make the time format "%H:%M:%S" but the "Avg Session Duration" is still being returned wrong. Is there a way to return the "Avg Session Duration" in an hour, min, second format?

0 Karma
1 Solution

Gilberto_Castil
Splunk Employee
Splunk Employee

This will likely do what you are looking for:

rename "Avg Session Duration(minutes)" AS avgSessionDuration 
| fieldformat avgSessionDuration=tostring(avgSessionDuration,"duration") 

alt text

This has also been hacked in the past to make even prettier:

rename "Avg Session Duration(minutes)" AS avgSessionDuration 
| eval pretty_AvgSessionDuration = floor(avgSessionDuration/60)." Hours ".floor(floor(avgSessionDuration - (avgSessionDuration/60))/60)." Min"

alt text

View solution in original post

Gilberto_Castil
Splunk Employee
Splunk Employee

This will likely do what you are looking for:

rename "Avg Session Duration(minutes)" AS avgSessionDuration 
| fieldformat avgSessionDuration=tostring(avgSessionDuration,"duration") 

alt text

This has also been hacked in the past to make even prettier:

rename "Avg Session Duration(minutes)" AS avgSessionDuration 
| eval pretty_AvgSessionDuration = floor(avgSessionDuration/60)." Hours ".floor(floor(avgSessionDuration - (avgSessionDuration/60))/60)." Min"

alt text

View solution in original post

JoeSco27
Communicator

Thank you, this works perfectly

0 Karma

reneedeleon
Engager

What if you wanted to add days?

0 Karma

cramasta
Builder

please provide example of how the minute field in the events look before 1 minute and after 1 minute

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.