Splunk Search

When using the transaction command, how do I format the duration into H:M:S?

clarksinthehill
Explorer

I'm sure this may have been asked before. When using transaction, I would like to format the duration into H:M:S, my search results for jobduration looks like 19 is being added to the result. Any help is appreciated.

Search is:

sourcetype=tws_merged (job_cpu_name ="cclita*" OR job_cpu_name ="cplisa3*" OR job_cpu_name = "cpaisa*f" OR job_cpu_name="lp0d7*") job_stream_name!="UNIXDLY" | transaction job_name host startswith"Jobman streamed" endswith="has completed SUCCESSFULLY" | eval Date=strftime(_time, "%m-%d-%y") | eval JobDuration=strftime(duration, "%H:%M:%S") | table Date job_name JobDuration

Sample Results:

02-03-16    ELSHPCST    02:56:52
02-04-16    ELVALRTD    19:00:00
02-04-16    ELVALRTPE   19:00:00
02-04-16    ELVALOOS    19:00:00
02-04-16    ELVALRTD    19:00:00
02-04-16    ELVALRTPE   19:00:00
0 Karma
1 Solution

javiergn
Super Champion

Use this instead:

| eval JobDuration = tostring(duration, "duration")

View solution in original post

0 Karma

javiergn
Super Champion

Use this instead:

| eval JobDuration = tostring(duration, "duration")
0 Karma

clarksinthehill
Explorer

Sure - it is.

sourcetype=tws_merged (job_cpu_name ="cclita*" OR job_cpu_name ="cplisa3*" OR job_cpu_name = "cpaisa*f" OR job_cpu_name="lp0d7*") job_stream_name!="UNIXDLY" 
 | transaction job_name host startswith"Jobman streamed" endswith="has completed SUCCESSFULLY" 
 | eval Date = strftime(_time, "%m-%d-%y") 
 | eval JobDuration = strftime(duration, "duration")
 | table Date, job_name,  JobDuration
0 Karma

javiergn
Super Champion

Ok, I can see the problem.
I made a mistake when I copied and pasted your code.

Instead of strftime you have to use the tostring function for JobDuration.

That is:

| eval JobDuration = tostring(duration, "duration")

Let me know if that helps. I have already fixed my two answers below.

clarksinthehill
Explorer

Perfect! Thanks for the help.

0 Karma

javiergn
Super Champion

No worries. If this is resolved please remember to mark is as answered so that others can benefit from it in the future.

0 Karma

clarksinthehill
Explorer

Thanks for the reply, using the above my results now include duration as a string. Any ideas?

02-05-16 ELINVPUB duration
02-05-16 ELLKPPARN duration
02-05-16 ELVALRTD duration
02-05-16 ELVALRTD duration

0 Karma

javiergn
Super Champion

Errrm, that shouldn't be the case unless your duration field is not a valid duration.
Can you post your whole query here?
Based on your comments it should be something like:

sourcetype=tws_merged (job_cpu_name ="cclita*" OR job_cpu_name ="cplisa3*" OR job_cpu_name = "cpaisa*f" OR job_cpu_name="lp0d7*") job_stream_name!="UNIXDLY" 
| transaction job_name host startswith"Jobman streamed" endswith="has completed SUCCESSFULLY" 
| eval Date = strftime(_time, "%m-%d-%y") 
| eval JobDuration = tostring(duration, "duration")
| table Date, job_name,  JobDuration
0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 3)

Welcome back to Splunk Classroom Chronicles, our ongoing blog series that pulls back the curtain on Splunk ...

Operationalizing TDIR: Building a More Resilient, Scalable SOC

Optimizing SOC workflows with a unified, risk-based approach to Threat Detection, Investigation, and Response ...

Almost Too Eventful Assurance: Part 1

Modern IT and Network teams still struggle with too many alerts and isolating issues before they are notified. ...