Splunk Search

How to sort the average time??

chitreshakumar
Communicator

I have on field named average duration which is right now sorting alphabetically.
Are there any way we can sort it by month,day ,hours and minutes then in numerical order??

0 Karma

nickhills
Ultra Champion

Try this!

<your search>|table Name "Average duration"
|rex field="Average duration" "(?<val>\d+\.?\d+)\s(?<unit>\w+)"
|evalmultiplier=case(unit=="seconds",1,unit="minutes",60,unit=="hrs",3600,unit=="days",86400,unit="months",2592000)
|eval durseconds=(val*multiplier)
|sort -durseconds|fields Name "Average duration"
If my comment helps, please give it a thumbs up!
0 Karma

mayurr98
Super Champion

Try this:

 | eval month_num=strftime(_time,"%m") | eval Month=date_mday."-".date_month."-".date_year."-".date_hour.":".date_minute | stats count by month_num,Month date_hour date_mday date_minute | sort - limit=0 month_num date_mday date_hour date_minute
0 Karma

chitreshakumar
Communicator

Thanks for your reply!!
But there is only one field that is having the average count for every person .I want a logic for that kind of sorting.

0 Karma

nickhills
Ultra Champion

Can you post some example data?
What format are the values in?

If my comment helps, please give it a thumbs up!
0 Karma

chitreshakumar
Communicator

Name Average duration
X 1.4 hrs
Y 6.2 minutes
Z 2.9 days
XY 20 days
YZ 22minutes
A 1.2 months

Something like this.Since its confidential so can't post the original .SO sample one I am posting

0 Karma

mayurr98
Super Champion

this is your input data right?
and what output you want?

0 Karma

chitreshakumar
Communicator

This is the input .I want output like .
While ascending
Y 6.2 minutes
YZ 22minutes
X 1.4 hrs
Z 2.9 days
XY 20 days
A 1.2 months

Descending
A 1.2 months
XY 20 days
Z 2.9 days
X 1.4 hrs
YZ 22minutes
Y 6.2 minutes

0 Karma

nickhills
Ultra Champion

hmm... yuk!

probably just a formatting error - but can you confirm there is always a space between the number and the unit.
Also, is it hrs, or hours?

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...