Splunk Search

How to convert time duration in minutes?

ramkyreddy
Explorer

ramkyreddy_0-1691497198124.png

I want convert minutes like (1.78,1.80,1.84,1.95) to (1h:44m,1h.55m,1h.44m,1h.58m)

for example we have 1 hour 95 minutes, but i want   1 hour 58 minutes

This my query
| stats count(eval(status="FAIL")) as fail_count,  sum(duration) as hours by ww,kit,endtime
| eval hours = round(((hours/60)/60),2)
| eval hours=round(sum(hours),2)

Could you please help out this

Labels (1)
Tags (1)
0 Karma

ramkyreddy
Explorer

After removing the seconds from my query, I tried with below query
| stats count(eval(status="FAIL")) as fail_count, sum(duration) as hours by ww, kit, endtime
| eval hours=tostring(hours,"duration")

I got the output like this 

ramkyreddy_0-1691578982939.png

But i want to sum up all the values, i tried with this command not getting  any values
| eval hours=round(sum(hours),2)

ramkyreddy_1-1691579275018.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Not clear what you mean about removing seconds as they still appear to be in your durations.

What sum are you trying to perform as this would normally be used as an aggregate function to a stats command, not an eval command

0 Karma

ramkyreddy
Explorer

After using this command for a duration the values are split in the 1st pick, so I want to sum all the duration values into a single line like in pick 2
| stats count(eval(status="FAIL")) as fail_count, sum(duration) as hours by ww, kit, endtime
| eval hours=tostring(hours,"duration")

ramkyreddy_1-1691591722395.png  

ramkyreddy_2-1691591884231.png

 

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Neither of these pictures relate to the search query you say you are using so I am not sure how to advise you further

0 Karma

ramkyreddy
Explorer

yes, this picture is related to query 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

How are they related? One has a field called hours and the picture has a field called Duration_in_Hrs. One looks like it produces single value fields and the other appears to produce multi-value fields.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

 

| stats count(eval(status="FAIL")) as fail_count,  sum(duration) as hours by ww,kit,endtime
| eval hours=tostring(hours,"duration")

 

Admittedly, this will give you HH:MM:SS but you could remove the seconds from hours beforehand if you need to

Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...