Hi, I have a log file that has a field called "TimeTaken".
The values of this field are in the format:
This signifies how long this operation took in HH:MM;SS;ms format (per each log line).
I am trying to figure out a way to do calculations on this field, for example, get an Average "timetaken" or how many events took longer than 00:12:00:00 (12 minutes) etc.
Is there any way this can be done using a clever Splunk search?
Any help would be much appreciated.
I think it will be easier if you converted to seconds, then do your average from there...
| eval Hr=(mvindex(split(TimeTaken,":"),0))
| eval Hr=Hr*60*60
| eval Mn=(mvindex(split(TimeTaken,":"),1))
| eval Mn=Mn*60
| eval Sc=mvindex(split(TimeTaken,":"),2)
| eval newTime=(Hr+Mn+Sc)/60
View solution in original post
This works perfectly! Thank you so much for the help. You guys are awesome!!!
glad I was able to help!