Splunk Search

## How to edit my search to find the sum and average of durations?

Path Finder

I have found a search that is able to get me the duration between 2 fields, but I need to add them and/or get their average of them.

``````index="purchase" |eval start=strptime(StartDate,"%Y-%m-%d %H:%M:%S") |eval end=strptime(EndDate,"%Y-%m-%d %H:%M:%S") |eval diff = tostring((end - start), "duration") |table diff
``````

Output:

``````4+00:01:28.000000
3+12:55:13.000000
3+03:38:04.000000
6+14:49:01.000000
4+00:45:39.000000
``````

Is it possible to add them or get their average? I am trying:

``````stats sum(diff) by Group
stats avg(diff) by Group
``````

The output I am looking for is:

``````Group   |   Total Time Taken               Group   |   Average Time Taken
________________________                   __________________________
Group1  |   2+22:04:52.000000              Group1  |   22:04:52.000000
Group2  |   2+10:41:29.000000              Group2  |   10:41:29.000000
Group3  |   2+06:25:43.000000              Group3  |   06:25:43.000000
``````

Tags (3)
1 Solution
Legend

Do the sum/avg before you change the format to duration. So try this

``````... |eval diff = end-start | eval diff=tostring(diff, "duration") | table diff
``````

OR

``````... |eval diff = end-start | stats sum(diff) as diff | eval diff=tostring(diff, "duration")
``````
Legend

Do the sum/avg before you change the format to duration. So try this

``````... |eval diff = end-start | eval diff=tostring(diff, "duration") | table diff
``````

OR

``````... |eval diff = end-start | stats sum(diff) as diff | eval diff=tostring(diff, "duration")
``````
.conf21 CFS Extended through 5/20!

### Don't miss your chance to share your Splunk wisdom in-person or virtually at .conf21!Call for Speakers hasbeen extended throughThursday, 5/20! Submit Now! >

Get Updates on the Splunk Community!