How to find total execution time for multiple events?

[din98]

Hey all,

I have a summary table that shows these values. Each error log and log in the 'Total logs' column (which contains error logs and successful logs) have a unique timestamp.

Process	Error logs	Total logs
A	5	10
B	6	15
C	7	9

I want to find the total execution time for the error logs and the total logs for each process by adding the total execution times of the error/successful logs under each process. I am hoping to get a summary table like the one shown below.

Process	Error logs	Total logs	Total execution time
A	5	10	2 minutes
B	6	15	50 seconds
C	7	9	4 minutes

Any help would be much appreciated. Thanks!

[ITWhisperer]

| eval starttime=strptime(started,"%Y-%m-%d %H:%M:%S.%7Q%:z")
| eval endtime=strptime(ended,"%Y-%m-%d %H:%M:%S.%7Q%:z")
| eval duration=endtime-starttime
| stats sum(errorLogs) as errorLogs sum(totalLogs) as totalLogs sum(duration) as duration by process
| fieldformat duration=tostring(duration, "duration")

[din98]

Hi @ITWhisperer,

I tried that query but the 'duration' column only shows blank fields.

[ITWhisperer]

Please try this runanywhere example to see if the functions work in your environment

| makeresults
| eval started="2022-07-25 11:35:17.3605798+00:00"
| eval ended="2022-07-25 11:48:55.4371325+00:00"
| eval starttime=strptime(started,"%Y-%m-%d %H:%M:%S.%7Q%:z")
| eval endtime=strptime(ended,"%Y-%m-%d %H:%M:%S.%7Q%:z")
| eval duration=endtime-starttime
| fieldformat duration=tostring(duration,"duration")

[din98]

@kamlesh_vaghela

here is the sample.

[kamlesh_vaghela]

@din98
Can you please share all sample events as well with the timestamp, error logs, and successful logs? This will be helpful to suggest proper solution.
KV