I have a data like below
Servename downtime
Web1 7 day 2 h
Web2 2 h 23 min
Web2 20 min
Web3. 17 min
Have severname and downtime fields. Servernames can be same with different donwtime available.
How can I group this by servename by adding the downtimes in to single row of per server. Help us with spl query
Is the downtime already / previously available as a numeric e.g. number of seconds? If not, you would have to convert it to a numeric by parsing the string into its constituent parts and multiply until you have the number of seconds. You can then use stats with the sum aggregation function to calculate the total downtime for each host.
Hi
I don't have the numeric field.
Any quick suggestion on converting this type of string to numeric field?
| rex field=downtime "((?<day>\d+)\sday\s?)?((?<hour>\d+)\sh\s?)?((?<minute>\d+)\smin\s?)?"
| fillnull value=0 day hour minute
| eval duration=((((day * 24) + hour) * 60) + minute) * 60