Splunk Search

How to convert time duration in minutes?

ramkyreddy
Explorer

ramkyreddy_0-1691497198124.png

I want convert minutes like (1.78,1.80,1.84,1.95) to (1h:44m,1h.55m,1h.44m,1h.58m)

for example we have 1 hour 95 minutes, but i want   1 hour 58 minutes

This my query
| stats count(eval(status="FAIL")) as fail_count,  sum(duration) as hours by ww,kit,endtime
| eval hours = round(((hours/60)/60),2)
| eval hours=round(sum(hours),2)

Could you please help out this

Labels (1)
Tags (1)
0 Karma

ramkyreddy
Explorer

After removing the seconds from my query, I tried with below query
| stats count(eval(status="FAIL")) as fail_count, sum(duration) as hours by ww, kit, endtime
| eval hours=tostring(hours,"duration")

I got the output like this 

ramkyreddy_0-1691578982939.png

But i want to sum up all the values, i tried with this command not getting  any values
| eval hours=round(sum(hours),2)

ramkyreddy_1-1691579275018.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Not clear what you mean about removing seconds as they still appear to be in your durations.

What sum are you trying to perform as this would normally be used as an aggregate function to a stats command, not an eval command

0 Karma

ramkyreddy
Explorer

After using this command for a duration the values are split in the 1st pick, so I want to sum all the duration values into a single line like in pick 2
| stats count(eval(status="FAIL")) as fail_count, sum(duration) as hours by ww, kit, endtime
| eval hours=tostring(hours,"duration")

ramkyreddy_1-1691591722395.png  

ramkyreddy_2-1691591884231.png

 

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Neither of these pictures relate to the search query you say you are using so I am not sure how to advise you further

0 Karma

ramkyreddy
Explorer

yes, this picture is related to query 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

How are they related? One has a field called hours and the picture has a field called Duration_in_Hrs. One looks like it produces single value fields and the other appears to produce multi-value fields.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

 

| stats count(eval(status="FAIL")) as fail_count,  sum(duration) as hours by ww,kit,endtime
| eval hours=tostring(hours,"duration")

 

Admittedly, this will give you HH:MM:SS but you could remove the seconds from hours beforehand if you need to

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...

Network to App: Observability Unlocked [May & June Series]

In today’s digital landscape, your environment is no longer confined to the data center. It spans complex ...