Splunk Search

Search average for time-taken field

New Member

Hi, I have a log file that has a field called "TimeTaken".

The values of this field are in the format:

00:01:27.763
00:02:10.15
00:01:36.175
00:00:48.368
00:00:22.692

etc..
This signifies how long this operation took in HH:MM;SS;ms format (per each log line).

I am trying to figure out a way to do calculations on this field, for example, get an Average "timetaken" or how many events took longer than 00:12:00:00 (12 minutes) etc.

Is there any way this can be done using a clever Splunk search?

Any help would be much appreciated.

0 Karma
1 Solution

Path Finder

I think it will be easier if you converted to seconds, then do your average from there...
*adding /60

| eval Hr=(mvindex(split(TimeTaken,":"),0))
| eval Hr=Hr*60*60
| eval Mn=(mvindex(split(TimeTaken,":"),1))
| eval Mn=Mn*60
| eval Sc=mvindex(split(TimeTaken,":"),2)
| eval newTime=(Hr+Mn+Sc)/60

View solution in original post

0 Karma

Path Finder

I think it will be easier if you converted to seconds, then do your average from there...
*adding /60

| eval Hr=(mvindex(split(TimeTaken,":"),0))
| eval Hr=Hr*60*60
| eval Mn=(mvindex(split(TimeTaken,":"),1))
| eval Mn=Mn*60
| eval Sc=mvindex(split(TimeTaken,":"),2)
| eval newTime=(Hr+Mn+Sc)/60

View solution in original post

0 Karma

New Member

Hi rslama,
This works perfectly! Thank you so much for the help. You guys are awesome!!!

0 Karma

Path Finder

glad I was able to help!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!