Splunk Search

How can I create duplicate events by duration hours?

Hanliamadeus
Explorer

Hello experts, I am working on a stats of meetings. 

As the attached photo shows, this meeting lasts for 7 (duration_hour) hours which starts at 8 AM (date_hour). I need to duplicate this event 7 times by adding 1 hour at date_hour with each time.

The final result I want is :

date_hour_timeThe rest fields
810/29/2020 8:00same
910/29/2020 9:00same
1010/29/2020 10:00same
1110/29/2020 11:00same
1210/29/2020 12:00same
1310/29/2020 13:00same
1410/30/2020 14:00same

 

Looking forward to your answers, thank you.

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults | eval duration_hour=7 | eval other="dummy"
| eval times=mvrange(_time, _time+(duration_hour * 60 * 60), "1h")
| mvexpand times
| eval _time=times

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults | eval duration_hour=7 | eval other="dummy"
| eval times=mvrange(_time, _time+(duration_hour * 60 * 60), "1h")
| mvexpand times
| eval _time=times
0 Karma

Hanliamadeus
Explorer

It works, thank you very much.

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...