Splunk Search

How to format field values of a varying field name?

auaave
Communicator

Hey Guys,

I have events with duration (seconds), then I chart the sum of duration per week. So now, the field names are the week numbers and the values are the duration. Formatting to[h%:m%:s%] converts my duration to string that is why I can't format the duration before charting.

How can I format the duration now to [h%:m%:s%] when my field names (week number) are changing every week?

| bin _time span=1w | convert timeformat=("%V") ctime(_time) 
| chart sum(DURATION) as duration over DESCRIPTION by _time useother=f 
| addtotals 
| sort Total desc limit=10

Thank you!

0 Karma

mayurr98
Super Champion

hey you can try something like this

| bin _time span=1w 
| convert timeformat=("%V") ctime(_time) 
| chart sum(DURATION) as duration over DESCRIPTION by _time useother=f 
| addtotals 
| sort Total desc limit=10 
| foreach * 
    [ eval <<FIELD>>=if("<<FIELD>>" == "DESCRIPTION",DESCRIPTION,tostring('<<FIELD>>',"duration")) ]

let me know if this helps!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...