Splunk Search

Convert duration in hours to duration in minutes

zoebanning
Path Finder

Hello Splunk Community, 

Can anyone help me build a query based on the below;

 

I have built a query which calculates the total duration of multiple events over a period of time. 

What I am trying to do now is create a timechart to show the _time on x-axis and duration on y-axis. 

I think I need to convert the duration from hours to minutes but not sure how to do this.

Below is an example of the output from my original query I am trying to visualise in a timechart;

 _time duration (in hours)
2021-10-1203:56:30
2021-10-1304:27:25
2021-10-1404:21:03
2021-10-1807:11:04

 

THANK YOU (in advance)

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Perhaps you should be changing the query that generates that field "duration (in hours)" to one that generates it in the granularity you need.

Is your existing query performing some calculation between two numbers to calculate duration. If so, then just use that rather than format it as string.

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

Perhaps you should be changing the query that generates that field "duration (in hours)" to one that generates it in the granularity you need.

Is your existing query performing some calculation between two numbers to calculate duration. If so, then just use that rather than format it as string.

 

venkatasri
SplunkTrust
SplunkTrust

Hi @zoebanning 

Try this i wish there would be direct function to,

| makeresults 
| eval time="03:56:30" 
| eval epoch=strptime(time, "%H:%M:%S") 
| eval hours=strftime(epoch, "%H"), sec=strftime(epoch, "%S"), m=strftime(epoch, "%M") 
| eval minutes= hours*60 + m + (sec / 60)

--

An upvote would be appreciated if this reply helps!

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...