Splunk Search

Calculate the average run duration for a job and display as a visualization

christinaef07
Loves-to-Learn Everything

Hi everyone! In my logs coming in, I log the duration for a job to complete, for several different jobs. Example of duration:

1:17:42   -----> this would be 1 hr, 17 minutes, 42 seconds

How can i calculate the average duration for each job?  I want something like this: 

Jobs       |.      Duration

___________________

Job 1.     |.    0:17:41

Job 2.     |.     1:41:16

Job 3.      |.    1:05:13

 

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Here's one way.  There may be others.

... | rex field=duration "(?<hr>\d+):(?<min>\d+):(?<sec>\d+)"
| eval durationSecs = (hr*3600) + (min*60) + sec
| stats avg(durationSecs) as Duration by Jobs
| fieldformat Duration = tostring(Duration, "duration")
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...