Splunk Search

Calculating Average Time Span

capri1231
New Member

I am having problems calculating an average time span. I need to determine how log it takes for a technician to "acknowledge" a ticket when it is created by the Help Desk.

source="servername" Assignee="*" GroupName="TierII" OR GroupName="TierIII" 
| stats min(DateTimeAssign) AS begin max(DateTimeAcknow) AS end by CallID,GroupName,Assignee,Priority 
| eval duration=round(end-begin) | eval hours=duration/3600 | eval minutes=round(duration/60) 
| eval Created=strftime(begin," %b %d, %Y %T %p") 
| eval Closed=strftime(end," %b %d, %Y %T %p")
| chart avg(hours) values(CallID) values(Created) as Assigned values(Closed) as Ack values(minutes) over GroupName 
Tags (1)
0 Karma

lguinn2
Legend

Try this

source="servername" Assignee="*" GroupName="TierII" OR GroupName="TierIII" 
| stats min(DateTimeAssign) AS begin max(DateTimeAcknow) AS end by CallID,GroupName,Assignee,Priority 
| eval duration=round(end-begin) 
| eval Created=strftime(begin," %b %d, %Y %T %p") 
| eval Closed=strftime(end," %b %d, %Y %T %p")
| stats avg(duration) as avgDuration values(CallID) values(Created) as Assigned values(Closed) as Ack by GroupName
| fieldformat avgDuration = tostring(avgDuration,"duration")
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...