Splunk Search

How to convert time secs into HH:MM format?

sekhar463
Path Finder

Hai All,

from the below search  how to convert secs to HH:MM format 

age fields is getting time in secs

 

index=_internal source=*metrics.log group=tcpin_connections earliest=-2d@d
| eval Host=coalesce(hostname, sourceHost)
| eval age = (now() - _time )
| stats min(age) as age, max(_time) as LastTime by Host
| convert ctime(LastTime) as "Last Active On"
| eval Status= case(age < 1800,"Running",age > 1800,"DOWN") | rename age as Age
| sort Status | table Host, Status, Age,"Last Active On"

Labels (1)
0 Karma

sekhar463
Path Finder

Hi Thanks,

this query i am using for to get UF status 

but query taking long time if i am trying to filter status =DOWN 

how we can modify this search fasten this query or how we can take time frame to get results

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sekhar463,

if your search is slow there could be two issues:

  • very many data,
  • you're using a slow storage.

for the first issue, you can accelerate your search in many ways, e.g. using a summary index.

For the second issue, remember that storage is the bottleneck of each Splunk system, and Splunk requires at least 800 (better 1200) IOPS for Hot and Warm Buckets, so the only solution is to use a faster storage.

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sekhar463,

you can use eval tostring:

index=_internal source=*metrics.log group=tcpin_connections earliest=-2d@d
| eval Host=coalesce(hostname, sourceHost)
| eval age=(now()-_time)
| stats 
   min(age) AS age 
   max(_time) AS LastTime 
   BY Host
| convert ctime(LastTime) AS "Last Active On"
| eval Status=if(age< 1800,"Running","DOWN") 
| rename age AS Age
| eval Age=tostring(Age,"duration")
| sort Status 
| table Host Status Age "Last Active On"

Ciao.

Giuseppe

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...