Splunk Search

How to convert time duration in minutes?

ramkyreddy
Explorer

ramkyreddy_0-1691497198124.png

I want convert minutes like (1.78,1.80,1.84,1.95) to (1h:44m,1h.55m,1h.44m,1h.58m)

for example we have 1 hour 95 minutes, but i want   1 hour 58 minutes

This my query
| stats count(eval(status="FAIL")) as fail_count,  sum(duration) as hours by ww,kit,endtime
| eval hours = round(((hours/60)/60),2)
| eval hours=round(sum(hours),2)

Could you please help out this

Labels (1)
Tags (1)
0 Karma

ramkyreddy
Explorer

After removing the seconds from my query, I tried with below query
| stats count(eval(status="FAIL")) as fail_count, sum(duration) as hours by ww, kit, endtime
| eval hours=tostring(hours,"duration")

I got the output like this 

ramkyreddy_0-1691578982939.png

But i want to sum up all the values, i tried with this command not getting  any values
| eval hours=round(sum(hours),2)

ramkyreddy_1-1691579275018.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Not clear what you mean about removing seconds as they still appear to be in your durations.

What sum are you trying to perform as this would normally be used as an aggregate function to a stats command, not an eval command

0 Karma

ramkyreddy
Explorer

After using this command for a duration the values are split in the 1st pick, so I want to sum all the duration values into a single line like in pick 2
| stats count(eval(status="FAIL")) as fail_count, sum(duration) as hours by ww, kit, endtime
| eval hours=tostring(hours,"duration")

ramkyreddy_1-1691591722395.png  

ramkyreddy_2-1691591884231.png

 

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Neither of these pictures relate to the search query you say you are using so I am not sure how to advise you further

0 Karma

ramkyreddy
Explorer

yes, this picture is related to query 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

How are they related? One has a field called hours and the picture has a field called Duration_in_Hrs. One looks like it produces single value fields and the other appears to produce multi-value fields.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

 

| stats count(eval(status="FAIL")) as fail_count,  sum(duration) as hours by ww,kit,endtime
| eval hours=tostring(hours,"duration")

 

Admittedly, this will give you HH:MM:SS but you could remove the seconds from hours beforehand if you need to

Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...