Duration Filter help

[jerinvarghese]

Hi All,

Need help in the Duration filter.

Code: 

index=opennms "ciscoLwappApIfUpNotify" OR "ciscoLwappApIfDownNotify"
| rex field=eventuei "ciscoLwappApIf(?<Status>.+)"
| stats max(_time) as Time latest(Status) as Status by nodelabel
| where Status="DownNotify"

| fieldformat Time=strftime(Time,"%Y-%m-%d %l:%M:%S")
| eval Downtime = now() - Time
| eval Downtime = tostring(Downtime, "duration")
| rex field=Downtime "(?P<Downtime>[^.]+)"

| table nodelabel, Status, Downtime, Time

Sample output: 

nodelabel	Status	Downtime	Time
USBTNBTECE	DownNotify	0:12:02	12/9/2020 2:36
USJOLWLC	DownNotify	1:31:21	12/9/2020 2:17
USMBP	DownNotify	2:08:25	12/9/2020 1:39

Requirement is.: 

Filter/remove all those values less than 1 hr Downtime.

Tried all possibilities  "| where duration >3600"  but no output coming when giving this. Please suggest a solution. 

[scelikok · Accepted solution]

@jerinvarghese , you should filter the Downtime values before formatting like below;

index=opennms "ciscoLwappApIfUpNotify" OR "ciscoLwappApIfDownNotify"
| rex field=eventuei "ciscoLwappApIf(?<Status>.+)"
| stats max(_time) as Time latest(Status) as Status by nodelabel
| where Status="DownNotify"

| fieldformat Time=strftime(Time,"%Y-%m-%d %l:%M:%S")
| eval Downtime = now() - Time
| where Downtime > 3600
| eval Downtime = tostring(Downtime, "duration")
| rex field=Downtime "(?P<Downtime>[^.]+)"

| table nodelabel, Status, Downtime, Time