Splunk Search

Convert duration in hours to duration in minutes

zoebanning
Path Finder

Hello Splunk Community, 

Can anyone help me build a query based on the below;

 

I have built a query which calculates the total duration of multiple events over a period of time. 

What I am trying to do now is create a timechart to show the _time on x-axis and duration on y-axis. 

I think I need to convert the duration from hours to minutes but not sure how to do this.

Below is an example of the output from my original query I am trying to visualise in a timechart;

 _time duration (in hours)
2021-10-1203:56:30
2021-10-1304:27:25
2021-10-1404:21:03
2021-10-1807:11:04

 

THANK YOU (in advance)

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Perhaps you should be changing the query that generates that field "duration (in hours)" to one that generates it in the granularity you need.

Is your existing query performing some calculation between two numbers to calculate duration. If so, then just use that rather than format it as string.

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

Perhaps you should be changing the query that generates that field "duration (in hours)" to one that generates it in the granularity you need.

Is your existing query performing some calculation between two numbers to calculate duration. If so, then just use that rather than format it as string.

 

venkatasri
SplunkTrust
SplunkTrust

Hi @zoebanning 

Try this i wish there would be direct function to,

| makeresults 
| eval time="03:56:30" 
| eval epoch=strptime(time, "%H:%M:%S") 
| eval hours=strftime(epoch, "%H"), sec=strftime(epoch, "%S"), m=strftime(epoch, "%M") 
| eval minutes= hours*60 + m + (sec / 60)

--

An upvote would be appreciated if this reply helps!

Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...