Splunk Search

How to convert time duration in minutes?

ramkyreddy
Explorer

ramkyreddy_0-1691497198124.png

I want convert minutes like (1.78,1.80,1.84,1.95) to (1h:44m,1h.55m,1h.44m,1h.58m)

for example we have 1 hour 95 minutes, but i want   1 hour 58 minutes

This my query
| stats count(eval(status="FAIL")) as fail_count,  sum(duration) as hours by ww,kit,endtime
| eval hours = round(((hours/60)/60),2)
| eval hours=round(sum(hours),2)

Could you please help out this

Labels (1)
Tags (1)
0 Karma

ramkyreddy
Explorer

After removing the seconds from my query, I tried with below query
| stats count(eval(status="FAIL")) as fail_count, sum(duration) as hours by ww, kit, endtime
| eval hours=tostring(hours,"duration")

I got the output like this 

ramkyreddy_0-1691578982939.png

But i want to sum up all the values, i tried with this command not getting  any values
| eval hours=round(sum(hours),2)

ramkyreddy_1-1691579275018.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Not clear what you mean about removing seconds as they still appear to be in your durations.

What sum are you trying to perform as this would normally be used as an aggregate function to a stats command, not an eval command

0 Karma

ramkyreddy
Explorer

After using this command for a duration the values are split in the 1st pick, so I want to sum all the duration values into a single line like in pick 2
| stats count(eval(status="FAIL")) as fail_count, sum(duration) as hours by ww, kit, endtime
| eval hours=tostring(hours,"duration")

ramkyreddy_1-1691591722395.png  

ramkyreddy_2-1691591884231.png

 

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Neither of these pictures relate to the search query you say you are using so I am not sure how to advise you further

0 Karma

ramkyreddy
Explorer

yes, this picture is related to query 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

How are they related? One has a field called hours and the picture has a field called Duration_in_Hrs. One looks like it produces single value fields and the other appears to produce multi-value fields.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

 

| stats count(eval(status="FAIL")) as fail_count,  sum(duration) as hours by ww,kit,endtime
| eval hours=tostring(hours,"duration")

 

Admittedly, this will give you HH:MM:SS but you could remove the seconds from hours beforehand if you need to

Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...