Splunk Search

## calculate sum of duration

Path Finder

Hi everyone,

I have calculated a duration field like this for example

``````Duration
00:22:02
00:19:26
00:04:26
00:20:16
00:16:47``````

with this search

``my_search | convert num("Duration") | stats sum("Duration") as "Total" | eval "Total"=tostring(\$Total\$,"duration")``

and I have the result of  this in a total of all my durations

``5+17:02:53``

I there a way to convert or transform this result in
5 days
17 hours
02 minutes
53 seconds

or something like this would also be great:

`5 days 17:02:53'`

Thank you very much!

Labels (4)

• ### timechart

Tags (2)
1 Solution
SplunkTrust

Split into two rex in case the duration is not more than 1 day.

``````| rex field=Total mode=sed "s/\+/ days /g"
| rex field=Total mode=sed "s/(\d\d):(\d\d):(\d\d)/\1 hours \2 minutes \3 seconds/g"``````
SplunkTrust

There is no built-in function to do that so you'll have to do it manually.  Start with a simple replace:

``| replace "+" with " days " in Total``

For something a little more complex, try rex:

``````| rex field=Total "(?:(?<days>\d+)\+)?(?<hours>\d+):(?<minutes>\d+):(?<seconds>\d+)"
| eval Total = if(isnull(days),0,days)." days ".hours." hours ".minutes." minutes ".seconds." seconds"``````

---
If this reply helps you, Karma would be appreciated.
SplunkTrust

Split into two rex in case the duration is not more than 1 day.

``````| rex field=Total mode=sed "s/\+/ days /g"
| rex field=Total mode=sed "s/(\d\d):(\d\d):(\d\d)/\1 hours \2 minutes \3 seconds/g"``````
Get Updates on the Splunk Community!