Hey all,
I have a summary table that shows these values. Each error log and log in the 'Total logs' column (which contains error logs and successful logs) have a unique timestamp.
Process | Error logs | Total logs |
A | 5 | 10 |
B | 6 | 15 |
C | 7 | 9 |
I want to find the total execution time for the error logs and the total logs for each process by adding the total execution times of the error/successful logs under each process. I am hoping to get a summary table like the one shown below.
Process | Error logs | Total logs | Total execution time |
A | 5 | 10 | 2 minutes |
B | 6 | 15 | 50 seconds |
C | 7 | 9 | 4 minutes |
Any help would be much appreciated. Thanks!
| eval starttime=strptime(started,"%Y-%m-%d %H:%M:%S.%7Q%:z")
| eval endtime=strptime(ended,"%Y-%m-%d %H:%M:%S.%7Q%:z")
| eval duration=endtime-starttime
| stats sum(errorLogs) as errorLogs sum(totalLogs) as totalLogs sum(duration) as duration by process
| fieldformat duration=tostring(duration, "duration")
Hi @ITWhisperer,
I tried that query but the 'duration' column only shows blank fields.
Please try this runanywhere example to see if the functions work in your environment
| makeresults
| eval started="2022-07-25 11:35:17.3605798+00:00"
| eval ended="2022-07-25 11:48:55.4371325+00:00"
| eval starttime=strptime(started,"%Y-%m-%d %H:%M:%S.%7Q%:z")
| eval endtime=strptime(ended,"%Y-%m-%d %H:%M:%S.%7Q%:z")
| eval duration=endtime-starttime
| fieldformat duration=tostring(duration,"duration")