Splunk Search

How to convert the value into months , days

jaibalaraman
Path Finder

Hi 

I am building dashboard for UPS monitoring and i would like to convert a specific metric which is battery age. 

Which give us some information about last battery changed however i would like to see the result in month , days like below 

Expected outcome - 1 month 20 days.

current outcome  below image 

jaibalaraman_0-1729637560233.png

Spl query

index="ups" indexed_is_service_aggregate=1 kpi=BatteryAge| lookup service_kpi_lookup _key as itsi_service_id OUTPUT title AS service_name | search service_name="MainUPS" |stats latest(alert_value) AS BatteryAge

Can anyone help me on this 

Labels (1)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What unit of time is your BatteryAge in, seconds, hours, days?

How long is a month?

If your current day is the 5th of the month and the age equates to 40 days, what result would you expect?

0 Karma

jaibalaraman
Path Finder

Hi Mus 
Thanks for help

However when i run the query i am getting an error message 
Error in 'makeresults' command: This command must be the first command of a search.

jaibalaraman_0-1729654254028.png

 




0 Karma

MuS
Legend

ah yes, this example needs to run on its own and will create sample events. but see my other reply this needs more logic

0 Karma

MuS
Legend

Hi there,

try this :

 

| makeresults | eval alert_value=1060, BatteryAge=strftime(alert_value, "%m months %d days")

 

this will return:

MuS_0-1729653964375.png

but not sure you then can use it in a single value panel. Just give it a try.

Hope this helps ...

Cheers, MuS

Update:

This is based on the simple assumption every month has 4 weeks, because I'm not a mathematician nor scientist 😉

| makeresults | eval alert_value=1060, secs=alert_value*86400, months=round(secs/604800), days=round(alert_value - ((secs- (secs/604800)) / 60 /60 /24)) , alert_value = months ." months ". days ." days"

 

0 Karma

MuS
Legend

Just noticed that will not work 🙄 will ned some loop hooping to get months and then days ....

0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 2)

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Index This | I am a number but I am countless. What am I?

January 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  Happy New Year! We’re ...

What’s New in Splunk Enterprise 9.4: Tools for Digital Resilience

PLATFORM TECH TALKS What’s New in Splunk Enterprise 9.4: Tools for Digital Resilience Thursday, February 27, ...