Splunk Search

Convert duration in hours to duration in minutes

zoebanning
Path Finder

Hello Splunk Community, 

Can anyone help me build a query based on the below;

 

I have built a query which calculates the total duration of multiple events over a period of time. 

What I am trying to do now is create a timechart to show the _time on x-axis and duration on y-axis. 

I think I need to convert the duration from hours to minutes but not sure how to do this.

Below is an example of the output from my original query I am trying to visualise in a timechart;

 _time duration (in hours)
2021-10-1203:56:30
2021-10-1304:27:25
2021-10-1404:21:03
2021-10-1807:11:04

 

THANK YOU (in advance)

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Perhaps you should be changing the query that generates that field "duration (in hours)" to one that generates it in the granularity you need.

Is your existing query performing some calculation between two numbers to calculate duration. If so, then just use that rather than format it as string.

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

Perhaps you should be changing the query that generates that field "duration (in hours)" to one that generates it in the granularity you need.

Is your existing query performing some calculation between two numbers to calculate duration. If so, then just use that rather than format it as string.

 

venkatasri
SplunkTrust
SplunkTrust

Hi @zoebanning 

Try this i wish there would be direct function to,

| makeresults 
| eval time="03:56:30" 
| eval epoch=strptime(time, "%H:%M:%S") 
| eval hours=strftime(epoch, "%H"), sec=strftime(epoch, "%S"), m=strftime(epoch, "%M") 
| eval minutes= hours*60 + m + (sec / 60)

--

An upvote would be appreciated if this reply helps!

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...