Sum duration to iterations of same id

[noa]

Hey,

I have an index 'test_iterations' which contains test data (start time, end time, iterationIndex ane TestName).

Each Test can appear more than once but with different iteration index

I need to get the test duration, which is the sum of the duration of each iteration

I used this query to find for a single test:

Index="test_iteration" TestRunId=someId TestName=someTestName | dedup IterationIndex | eval sum = 0 | foreach IterationIndex* [ eval sum = sum + strptime(EndTime, "%Y-%m-%d%H:%:M%:S.%N") - strptime(StartTime,  "%Y-%m-%d%H:%:M%:S.%N")] | table sum

Which provide me the right answer

But when I try to get all the tests duration in a run, I get an error.

My search:

Index="test_iteration" TestRunId=someTestRunId | dedup TestName | 

Eval dur = [ search Index="test_iteration" TestRunId=someId TestName=someTestName | dedup IterationIndex | eval sum = 0 | foreach IterationIndex* [ eval sum = sum + strptime(EndTime, "%Y-%m-%d%H:%:M%:S.%N") - strptime(StartTime,  "%Y-%m-%d%H:%:M%:S.%N")] | table sum] | table Duration, TestName

I get the error: error in 'eval' command: the expression is malformed. An unexpected character is reached at ')'.

But I don't get why?

Thanks.

[ITWhisperer]

I am surprised that you say the first query works. You have a typo in your format string for strptime, and foreach works on field names, not on the values of a particular field.

Please can you confirm what your working and failing queries are?

[noa]

The first query worked for me and return the right duration, how can it be? 

Each Test Iteration has a StartTime and EndTime. I get from this a single iteration duration and need to sum it.