Splunk Search

How to calculate the average time of day a job will finish with end_time field?

allan_newton
Path Finder

I have a table which has start_time & end_time of some jobs. Now i want to calculate the average at what point of time in a day the job ends.

start_time end_time
13/03/2014 11:12:29 am 13/03/2014 11:25:23 am
13/03/2014 12:02:05 pm 13/03/2014 12:15:29 pm
13/03/2014 12:29:00 pm 13/03/2014 12:58:20 pm
13/03/2014 01:00:30 pm 13/03/2014 01:12:59 pm

My average of end_time should tell me something like daily at "12:10:23 pm" the job will be finished.

Tags (3)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You could append this:

... | eval epoch_end = strptime(end_time, "%d/%m/%Y %H:%M:%S") | stats avg(epoch_end) as avg_epoch_end | eval avg_end = strftime(avg_epoch_end, "%d/%m/%Y %H:%M:%S")

View solution in original post

HiroshiSatoh
Champion

Try this!

(your search)|eval endtime_epoc=strptime(end_time,"%d/%m/%Y %I:%M:%S %P")|eval date=strftime(endtime_epoc,"%d/%m/%Y")|stats avg(endtime_epoc) as avg_endtime by date|eval avg_endtime=strftime(avg_endtime,"%I:%M:%S %P")|table date,avg_endtime

datasearchninja
Communicator

Send your table output to this:

| eval endtime_epoc=strptime(end_time, "%d/%m/%Y %I:%M:%S %p") | eval day_seconds=endtime_epoc%86400 | stats list(start_time) list(end_time) avg(day_seconds) as avg_day_seconds | eval avg_endtime=strftime(avg_day_seconds, "%I:%M:%S %p")

martin_mueller
SplunkTrust
SplunkTrust

You could append this:

... | eval epoch_end = strptime(end_time, "%d/%m/%Y %H:%M:%S") | stats avg(epoch_end) as avg_epoch_end | eval avg_end = strftime(avg_epoch_end, "%d/%m/%Y %H:%M:%S")
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Maximizing the Value of Splunk ES 8.x

Splunk Enterprise Security (ES) continues to be a leader in the Gartner Magic Quadrant, reflecting its pivotal ...