Splunk Search

Need Minutes and hours conversion

priya1926
Path Finder

Hi,

 

I am trying this cmd 

 index="wineventlog" host IN (*) EventCode=6006 OR EventCode="6005" Type=Information
| transaction host startswith=6006 endswith=6005 maxevents=2
| eval duration = duration + " Sec"
| table _time host duration

 

If the output in sec.. i need sec... if its in minutes then minutes .. if its in hours and if in days it should calculate the same.

 

Thanks in Advance

Labels (2)
0 Karma

skrajkumar_splu
Splunk Employee
Splunk Employee

Or you can try converting the duration to string and then add sec, mins via regex like below example

| eval duration=tostring(duration,"duration")| eval time_taken = replace(duration,"(\d+)\:(\d+)\:(\d+)","\1h \2min \3sec")

Random_Walk
Path Finder

I think this will help ...

index=wineventlog EventCode=6006 OR EventCode="6005" Type=Information
| transaction host startswith=6006 endswith=6005 maxevents=2
| eval Units=case(duration<60, " Sec", duration<3600, " Min", duration<86400, " Hours", duration>86400, " Days")
| eval Duration=case(duration<60, duration, duration<3600, duration/60, duration<86400, duration/3600, duration>86400, duration/86400)
| table _time host duration Duration Units

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...