Splunk Search

How to get rid of fields/columns generated by stats and eval commands?

sravan
Explorer

I want to find time difference between two events (duration some operation took) and plot a graph which shows how much time it took for each of the entity ... I gave some query mentioned below :

<base_search>|

| eval duration = duration_seconds + (60 * (duration_minutes + (60 * duration_hours)))
| fieldformat duration = tostring(duration, "duration")
| fieldformat duration_in_minutes = duration / 60

 

Now i got correct output in the form of a table , but with some extra fields Screenshot 2023-07-25 at 5.32.56 PM.pngI need first column (cls_id) and last column (duration_in_minutes) , Can someone help how can i get that?

I tried appending | table cls_id , duration_in_minutes , but that gives null value for "duration_in_minutes" field/column.

Labels (3)
0 Karma
1 Solution

sravan
Explorer

fieldformat also didnt work for me.

Below one worked:

 

<base_search>|

| eval duration = duration_seconds + (60 * (duration_minutes + (60 * duration_hours)))
| fieldformat duration = tostring(duration, "duration")
| fieldformat duration_in_minutes = duration / 60

| fields "cls_id", "duration_in_minutes"

| stats sum(duration_in_minutes) by cls_id

View solution in original post

0 Karma

cklunck
Path Finder

The simplest way is probably to use the | fields command:

<base_search> 
| stuff
| more stuff
| fields cis_id duration_in_minutes

 

This tells Splunk to only keep these two fields. (You can also write it as | fields + cis_id duration_in_minutes if you prefer the operator being shown.)

0 Karma

sravan
Explorer

I tried that as well , but i keep getting null/empty values for "duration_in_minutes" - same as how when i use below:  | table cls_id, duration_in_minutes. 

BTW when we use fields , will it stop processing all other intermediate fields and hence i dont see them?  

0 Karma

cklunck
Path Finder

I think you want to use eval instead of fieldformat, so it creates a new field. Fieldformat only creates a "view" into a field, which means we can't use it with the fields command later in the search. Sorry I didn't catch that the first time!

Something like this worked for me:

<base_search>|

| eval duration = duration_seconds + (60 * (duration_minutes + (60 * duration_hours)))
| fieldformat duration = tostring(duration, "duration")
| eval duration_in_minutes = duration / 60
| fields cls_id duration_in_minutes

 

Regarding your question about the fields command - yes, once you use fields to specify only the fields you wish to keep, then all the other fields are discarded from your results for the current search.

0 Karma

sravan
Explorer

fieldformat also didnt work for me.

Below one worked:

 

<base_search>|

| eval duration = duration_seconds + (60 * (duration_minutes + (60 * duration_hours)))
| fieldformat duration = tostring(duration, "duration")
| fieldformat duration_in_minutes = duration / 60

| fields "cls_id", "duration_in_minutes"

| stats sum(duration_in_minutes) by cls_id

0 Karma

isoutamo
SplunkTrust
SplunkTrust

One comment. When you are using fieldformat it doesn’t change the value of field, it just change the presentation of field on screen! This is useful if you want e.g. sort those fields numerically on screen by clicking column name. 
Based on that your fieldformat is not needed/used on previous SPL.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...