Splunk Search

How to sort the average time??

chitreshakumar
Communicator

I have on field named average duration which is right now sorting alphabetically.
Are there any way we can sort it by month,day ,hours and minutes then in numerical order??

0 Karma

nickhills
Ultra Champion

Try this!

<your search>|table Name "Average duration"
|rex field="Average duration" "(?<val>\d+\.?\d+)\s(?<unit>\w+)"
|evalmultiplier=case(unit=="seconds",1,unit="minutes",60,unit=="hrs",3600,unit=="days",86400,unit="months",2592000)
|eval durseconds=(val*multiplier)
|sort -durseconds|fields Name "Average duration"
If my comment helps, please give it a thumbs up!
0 Karma

mayurr98
Super Champion

Try this:

 | eval month_num=strftime(_time,"%m") | eval Month=date_mday."-".date_month."-".date_year."-".date_hour.":".date_minute | stats count by month_num,Month date_hour date_mday date_minute | sort - limit=0 month_num date_mday date_hour date_minute
0 Karma

chitreshakumar
Communicator

Thanks for your reply!!
But there is only one field that is having the average count for every person .I want a logic for that kind of sorting.

0 Karma

nickhills
Ultra Champion

Can you post some example data?
What format are the values in?

If my comment helps, please give it a thumbs up!
0 Karma

chitreshakumar
Communicator

Name Average duration
X 1.4 hrs
Y 6.2 minutes
Z 2.9 days
XY 20 days
YZ 22minutes
A 1.2 months

Something like this.Since its confidential so can't post the original .SO sample one I am posting

0 Karma

mayurr98
Super Champion

this is your input data right?
and what output you want?

0 Karma

chitreshakumar
Communicator

This is the input .I want output like .
While ascending
Y 6.2 minutes
YZ 22minutes
X 1.4 hrs
Z 2.9 days
XY 20 days
A 1.2 months

Descending
A 1.2 months
XY 20 days
Z 2.9 days
X 1.4 hrs
YZ 22minutes
Y 6.2 minutes

0 Karma

nickhills
Ultra Champion

hmm... yuk!

probably just a formatting error - but can you confirm there is always a space between the number and the unit.
Also, is it hrs, or hours?

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...