Splunk Search

Find average time duration in hh:mm

ajmanish
New Member

I am trying to find the average time duration in hh:mm from the data in one column. Below is the search query which gives me data as below and I want the average time duration in hh:mm like average time duration of a column is 01:22 or whatever the value is.

I tried looking for the same articles but nothing seem to work.
Any help would be greatly appreciated. Thank you

search month="Apr,2021" | stats count by "TotalTimeTaken (hh:MM)" |



"TotalTimeTaken (hh:MM)"
00:24
01:44
02:23
00:54


Labels (5)
0 Karma

s2_splunk
Splunk Employee
Splunk Employee

This should get you started: 

| makeresults 
| eval n="00:24 01:44 02:23 00:54" 
| makemv delim=" " n 
| mvexpand n 
| eval hhmm = substr("00:00:00",1,8-len(n)).n 
| convert dur2sec(hhmm) as seconds 
| stats avg(seconds) as avgsec 
| eval AvgDur = tostring(avgsec, "duration")

First four lines are generating test events from your example data. If you are fine with the average time in seconds, you can skip the last line. 

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...