Splunk Search

How to convert the value into months , days

jaibalaraman
Path Finder

Hi 

I am building dashboard for UPS monitoring and i would like to convert a specific metric which is battery age. 

Which give us some information about last battery changed however i would like to see the result in month , days like below 

Expected outcome - 1 month 20 days.

current outcome  below image 

jaibalaraman_0-1729637560233.png

Spl query

index="ups" indexed_is_service_aggregate=1 kpi=BatteryAge| lookup service_kpi_lookup _key as itsi_service_id OUTPUT title AS service_name | search service_name="MainUPS" |stats latest(alert_value) AS BatteryAge

Can anyone help me on this 

Labels (1)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What unit of time is your BatteryAge in, seconds, hours, days?

How long is a month?

If your current day is the 5th of the month and the age equates to 40 days, what result would you expect?

0 Karma

jaibalaraman
Path Finder

Hi Mus 
Thanks for help

However when i run the query i am getting an error message 
Error in 'makeresults' command: This command must be the first command of a search.

jaibalaraman_0-1729654254028.png

 




0 Karma

MuS
SplunkTrust
SplunkTrust

ah yes, this example needs to run on its own and will create sample events. but see my other reply this needs more logic

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi there,

try this :

 

| makeresults | eval alert_value=1060, BatteryAge=strftime(alert_value, "%m months %d days")

 

this will return:

MuS_0-1729653964375.png

but not sure you then can use it in a single value panel. Just give it a try.

Hope this helps ...

Cheers, MuS

Update:

This is based on the simple assumption every month has 4 weeks, because I'm not a mathematician nor scientist 😉

| makeresults | eval alert_value=1060, secs=alert_value*86400, months=round(secs/604800), days=round(alert_value - ((secs- (secs/604800)) / 60 /60 /24)) , alert_value = months ." months ". days ." days"

 

0 Karma

MuS
SplunkTrust
SplunkTrust

Just noticed that will not work 🙄 will ned some loop hooping to get months and then days ....

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...