Splunk Search

Doing math on results of sum(duration) of transaction?

splunk_newb
Explorer

I have a search that results in showing the time a phone was in a call in seconds by using sum(duration) of the events:

| transaction Tag | chart count(Tag) as NumberOfCalls sum(duration) as Time_in_call(seconds) by codec | sort sum(duration) | reverse

I'd like to get that the Time_in_call(seconds) to be in minutes. I thought it might be as simple as :

| transaction Tag | chart count(Tag) as NumberOfCalls sum(duration) as Time_in_call(seconds) / 60 by codec | sort sum(duration) | reverse

or something like | transaction Tag |eval Time_in_call(minutes) as sum(duration) / 60 | chart count(Tag) as NumberOfCalls Time_in_call(minutes) by codec | sort sum(duration) | reverse

It looks like eval doesn't allow sum() anything . This seems straightforward but I'm at a loss even after spending 30 minutes searching around here.

0 Karma
1 Solution

cmerriman
Super Champion

Alright, a few things about your syntax. in your chart, you're renaming sum(duration) as Time_in_call(seconds), and then trying to sort by sum(duration), which won't work, but then reversing the order of events, so try this to help be more efficient.

| transaction Tag | chart count(Tag) as NumberOfCalls sum(duration) as Time_in_call_seconds by codec |eval Time_in_call_minutes=round(Time_in_call_seconds/60,2)| sort 0 - Time_in_call_minutes 

this should eval the duration into minutes and sort the duration descending.

View solution in original post

cmerriman
Super Champion

Alright, a few things about your syntax. in your chart, you're renaming sum(duration) as Time_in_call(seconds), and then trying to sort by sum(duration), which won't work, but then reversing the order of events, so try this to help be more efficient.

| transaction Tag | chart count(Tag) as NumberOfCalls sum(duration) as Time_in_call_seconds by codec |eval Time_in_call_minutes=round(Time_in_call_seconds/60,2)| sort 0 - Time_in_call_minutes 

this should eval the duration into minutes and sort the duration descending.

splunk_newb
Explorer

Works like a champ. I didn't know that my results fields could be outside of the chart area. It's also interesting on how it summarizes this data without having to use sum() on it.

Thanks!

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...