Splunk Search

Doing math on results of sum(duration) of transaction?

Explorer

I have a search that results in showing the time a phone was in a call in seconds by using sum(duration) of the events:

| transaction Tag | chart count(Tag) as NumberOfCalls sum(duration) as Time_in_call(seconds) by codec | sort sum(duration) | reverse

I'd like to get that the Time_in_call(seconds) to be in minutes. I thought it might be as simple as :

| transaction Tag | chart count(Tag) as NumberOfCalls sum(duration) as Time_in_call(seconds) / 60 by codec | sort sum(duration) | reverse

or something like | transaction Tag |eval Time_in_call(minutes) as sum(duration) / 60 | chart count(Tag) as NumberOfCalls Time_in_call(minutes) by codec | sort sum(duration) | reverse

It looks like eval doesn't allow sum() anything . This seems straightforward but I'm at a loss even after spending 30 minutes searching around here.

Tags (3)
1 Solution
Super Champion

Alright, a few things about your syntax. in your chart, you're renaming sum(duration) as Time_in_call(seconds), and then trying to sort by sum(duration), which won't work, but then reversing the order of events, so try this to help be more efficient.

``````| transaction Tag | chart count(Tag) as NumberOfCalls sum(duration) as Time_in_call_seconds by codec |eval Time_in_call_minutes=round(Time_in_call_seconds/60,2)| sort 0 - Time_in_call_minutes
``````

this should eval the duration into minutes and sort the duration descending.

Super Champion

Alright, a few things about your syntax. in your chart, you're renaming sum(duration) as Time_in_call(seconds), and then trying to sort by sum(duration), which won't work, but then reversing the order of events, so try this to help be more efficient.

``````| transaction Tag | chart count(Tag) as NumberOfCalls sum(duration) as Time_in_call_seconds by codec |eval Time_in_call_minutes=round(Time_in_call_seconds/60,2)| sort 0 - Time_in_call_minutes
``````

this should eval the duration into minutes and sort the duration descending.

Explorer

Works like a champ. I didn't know that my results fields could be outside of the chart area. It's also interesting on how it summarizes this data without having to use sum() on it.

Thanks!

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20. Learn More or Register Now >

Get Updates on the Splunk Community!