Splunk Search

How to get rid of fields/columns generated by stats and eval commands?

sravan
Explorer

I want to find time difference between two events (duration some operation took) and plot a graph which shows how much time it took for each of the entity ... I gave some query mentioned below :

<base_search>|

| eval duration = duration_seconds + (60 * (duration_minutes + (60 * duration_hours)))
| fieldformat duration = tostring(duration, "duration")
| fieldformat duration_in_minutes = duration / 60

 

Now i got correct output in the form of a table , but with some extra fields Screenshot 2023-07-25 at 5.32.56 PM.pngI need first column (cls_id) and last column (duration_in_minutes) , Can someone help how can i get that?

I tried appending | table cls_id , duration_in_minutes , but that gives null value for "duration_in_minutes" field/column.

Labels (3)
0 Karma
1 Solution

sravan
Explorer

fieldformat also didnt work for me.

Below one worked:

 

<base_search>|

| eval duration = duration_seconds + (60 * (duration_minutes + (60 * duration_hours)))
| fieldformat duration = tostring(duration, "duration")
| fieldformat duration_in_minutes = duration / 60

| fields "cls_id", "duration_in_minutes"

| stats sum(duration_in_minutes) by cls_id

View solution in original post

0 Karma

cklunck
Path Finder

The simplest way is probably to use the | fields command:

<base_search> 
| stuff
| more stuff
| fields cis_id duration_in_minutes

 

This tells Splunk to only keep these two fields. (You can also write it as | fields + cis_id duration_in_minutes if you prefer the operator being shown.)

0 Karma

sravan
Explorer

I tried that as well , but i keep getting null/empty values for "duration_in_minutes" - same as how when i use below:  | table cls_id, duration_in_minutes. 

BTW when we use fields , will it stop processing all other intermediate fields and hence i dont see them?  

0 Karma

cklunck
Path Finder

I think you want to use eval instead of fieldformat, so it creates a new field. Fieldformat only creates a "view" into a field, which means we can't use it with the fields command later in the search. Sorry I didn't catch that the first time!

Something like this worked for me:

<base_search>|

| eval duration = duration_seconds + (60 * (duration_minutes + (60 * duration_hours)))
| fieldformat duration = tostring(duration, "duration")
| eval duration_in_minutes = duration / 60
| fields cls_id duration_in_minutes

 

Regarding your question about the fields command - yes, once you use fields to specify only the fields you wish to keep, then all the other fields are discarded from your results for the current search.

0 Karma

sravan
Explorer

fieldformat also didnt work for me.

Below one worked:

 

<base_search>|

| eval duration = duration_seconds + (60 * (duration_minutes + (60 * duration_hours)))
| fieldformat duration = tostring(duration, "duration")
| fieldformat duration_in_minutes = duration / 60

| fields "cls_id", "duration_in_minutes"

| stats sum(duration_in_minutes) by cls_id

0 Karma

isoutamo
SplunkTrust
SplunkTrust

One comment. When you are using fieldformat it doesn’t change the value of field, it just change the presentation of field on screen! This is useful if you want e.g. sort those fields numerically on screen by clicking column name. 
Based on that your fieldformat is not needed/used on previous SPL.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...