Splunk Search

Average between 2 fields D+HH:MM:SS

Abarny
Path Finder

Hi,

I try to realize an average enter 2 fields which appear in the form of D+HH:MM:SS so i converted with dur2sec. But the result is 0 i don't understand why. Can you help me to find why ? Thanks you.

| convert dur2sec(AAAA)
| convert dur2sec(BBB)
|stats sum(AAA) as C sum(BBB) as D dc(E) as F
| eval temps=D-C | eval moyen= temps/F
| fields moyen

0 Karma
1 Solution

woodcock
Esteemed Legend

Try this:

| eval duration=strptime(BBB,"%Y-%m-%d %H:%M:%S") - strptime(AAA,"%Y-%m-%d %H:%M:%S")
|stats savg(duration) AS moyen

View solution in original post

0 Karma

woodcock
Esteemed Legend

Try this:

| eval duration=strptime(BBB,"%Y-%m-%d %H:%M:%S") - strptime(AAA,"%Y-%m-%d %H:%M:%S")
|stats savg(duration) AS moyen
0 Karma

richgalloway
SplunkTrust
SplunkTrust

What is field E? Counting a field that doesn't exist will make F=0

---
If this reply helps you, Karma would be appreciated.
0 Karma

Abarny
Path Finder

This field exist, E is an unique identifier on 1 event

0 Karma

niketn
Legend

Have you validated BBB and AAAA values are different or not?
Can you add few data samples?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Abarny
Path Finder

Yes they are différents exemple : AAA = 2017-02-18 11:53:05
BBB = 2017-02-18 11:53:14

But no i can't add data sample ..

0 Karma

somesoni2
SplunkTrust
SplunkTrust

You said that your field values are in format D+HH:MM:SS (string formatted duration) but the sample values above shows that they are timestmap, which one is it? If it's timestamp then your convert dur2sec will fail and return 0/null. If they are timestamp, then give this a try

...your base search
| eval duration=strptime(BBB,"%Y-%m-%d %H:%M:%S")-strptime(AAA,"%Y-%m-%d %H:%M:%S")
|stats sum(duration) as duration dc(E) as F
| eval moyen= duration/F
| fields moyen

Abarny
Path Finder

Okay ! Thanks for your help !

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...