Splunk Search

How can I create duplicate events by duration hours?

Hanliamadeus
Explorer

Hello experts, I am working on a stats of meetings. 

As the attached photo shows, this meeting lasts for 7 (duration_hour) hours which starts at 8 AM (date_hour). I need to duplicate this event 7 times by adding 1 hour at date_hour with each time.

The final result I want is :

date_hour_timeThe rest fields
810/29/2020 8:00same
910/29/2020 9:00same
1010/29/2020 10:00same
1110/29/2020 11:00same
1210/29/2020 12:00same
1310/29/2020 13:00same
1410/30/2020 14:00same

 

Looking forward to your answers, thank you.

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults | eval duration_hour=7 | eval other="dummy"
| eval times=mvrange(_time, _time+(duration_hour * 60 * 60), "1h")
| mvexpand times
| eval _time=times

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults | eval duration_hour=7 | eval other="dummy"
| eval times=mvrange(_time, _time+(duration_hour * 60 * 60), "1h")
| mvexpand times
| eval _time=times
0 Karma

Hanliamadeus
Explorer

It works, thank you very much.

0 Karma
Get Updates on the Splunk Community!

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...

Application management with Targeted Application Install for Victoria Experience

Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...