Splunk Search

Convert Decimal to Time Format

nlisle
New Member

Hello, 

I currently have the below search will calculates on average how much time is being spent on the alerts that Splunk generates. On average, it has been calculated that 15 minutes would be spent on each alert for investigation etc. Therefore the below search was written. 

index="_internal" sourcetype="scheduler" thread_id="AlertNotifier*" alert_actions=email savedsearch_name=*
| stats count
| eval count=count/4

Result example: 14 Results x 15 Minutes = 210 Minutes/3 Hours 30 Minutes. My results are showing as '3.5 Hours. '

How could I change this so my final results will be in the format of '3 Hours 30 Minutes'.

Thanks.

N. 

 

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @nlisle,

you can use the tostring function (with the "duration" option) in the eval command, something like this:

| eval count=tostring(count,"duration") 

 Ciao.

Giuseppe

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index="_internal" sourcetype="scheduler" thread_id="AlertNotifier*" alert_actions=email savedsearch_name=*
| stats count
| eval count=count * 15 * 60
| eval count=tostring(count,"duration")
0 Karma
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...