Splunk Search

## Search average for time-taken field

Loves-to-Learn Lots

Hi, I have a log file that has a field called "TimeTaken".

The values of this field are in the format:

``````00:01:27.763
00:02:10.15
00:01:36.175
00:00:48.368
00:00:22.692
``````

etc..
This signifies how long this operation took in HH:MM;SS;ms format (per each log line).

I am trying to figure out a way to do calculations on this field, for example, get an Average "timetaken" or how many events took longer than 00:12:00:00 (12 minutes) etc.

Is there any way this can be done using a clever Splunk search?

Any help would be much appreciated.

Tags (4)
1 Solution
Path Finder

I think it will be easier if you converted to seconds, then do your average from there...

| eval Hr=(mvindex(split(TimeTaken,":"),0))
| eval Hr=Hr*60*60
| eval Mn=(mvindex(split(TimeTaken,":"),1))
| eval Mn=Mn*60
| eval Sc=mvindex(split(TimeTaken,":"),2)
| eval newTime=(Hr+Mn+Sc)/60

Path Finder

I think it will be easier if you converted to seconds, then do your average from there...

| eval Hr=(mvindex(split(TimeTaken,":"),0))
| eval Hr=Hr*60*60
| eval Mn=(mvindex(split(TimeTaken,":"),1))
| eval Mn=Mn*60
| eval Sc=mvindex(split(TimeTaken,":"),2)
| eval newTime=(Hr+Mn+Sc)/60

Loves-to-Learn Lots

Hi rslama,
This works perfectly! Thank you so much for the help. You guys are awesome!!!

Path Finder

glad I was able to help!

Get Updates on the Splunk Community!

#### Discover SplunkTrust and MVP Articles, Instant Translation, and More on Splunk ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

#### Integrating Kubernetes and Splunk Observability Cloud

We need end-to-end insight into our application environments to confidently ensure everything is up and ...

#### Index This | What has a tail and a head but no body?

July 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...