Total of 2 rows

[g_paternicola]

Hi everyone, I have a table which gives me 2 fields Username and Duration. How can I dedup the Username and add the total of the Duration in one row?

Thank you very much!

[kamlesh_vaghela]

@g_paternicola 

Can you please try this?

YOUR_SEARCH
| rex field="Duration" "(?<hours>\d+)h:(?<minutes>\d+)m:(?<seconds>\d+)s" 
| eval Duration = ((hours*60*60)+(minutes*60)+(seconds))
| stats sum(Duration) as Duration by Username
| eval Duration=tostring(Duration,"duration")

My Sample Search :

| makeresults 
| eval Username="A", Duration="0h:40m:42s" 
| append 
    [| makeresults 
    | eval Username="A", Duration="1h:40m:42s"] 
| rex field="Duration" "(?<hours>\d+)h:(?<minutes>\d+)m:(?<seconds>\d+)s" 
| eval Duration = ((hours*60*60)+(minutes*60)+(seconds))
| stats sum(Duration) as Duration by Username
| eval Duration=tostring(Duration,"duration")

 Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

[richgalloway]

The stats command will do that.

... | stats sum(Duration) as Duration by Username

For it to work well, however, the Duration field must be a number rather than a string.

[g_paternicola]

yeah, I also believe that, because I didn't get any results on the Duration