Splunk Search

Convert Decimal to Time Format

nlisle
New Member

Hello, 

I currently have the below search will calculates on average how much time is being spent on the alerts that Splunk generates. On average, it has been calculated that 15 minutes would be spent on each alert for investigation etc. Therefore the below search was written. 

index="_internal" sourcetype="scheduler" thread_id="AlertNotifier*" alert_actions=email savedsearch_name=*
| stats count
| eval count=count/4

Result example: 14 Results x 15 Minutes = 210 Minutes/3 Hours 30 Minutes. My results are showing as '3.5 Hours. '

How could I change this so my final results will be in the format of '3 Hours 30 Minutes'.

Thanks.

N. 

 

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @nlisle,

you can use the tostring function (with the "duration" option) in the eval command, something like this:

| eval count=tostring(count,"duration") 

 Ciao.

Giuseppe

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index="_internal" sourcetype="scheduler" thread_id="AlertNotifier*" alert_actions=email savedsearch_name=*
| stats count
| eval count=count * 15 * 60
| eval count=tostring(count,"duration")
0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...