Splunk Search

calculate sum of duration

g_paternicola
Path Finder

Hi everyone,

I have calculated a duration field like this for example

Duration
00:22:02
00:19:26
00:04:26
00:20:16
00:16:47

with this search

my_search | convert num("Duration") | stats sum("Duration") as "Total" | eval "Total"=tostring($Total$,"duration")


and I have the result of  this in a total of all my durations

5+17:02:53

I there a way to convert or transform this result in 
5 days
17 hours
02 minutes
53 seconds

or something like this would also be great:

5 days 17:02:53'

Thank you very much!

Labels (4)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Split into two rex in case the duration is not more than 1 day.

| rex field=Total mode=sed "s/\+/ days /g"
| rex field=Total mode=sed "s/(\d\d):(\d\d):(\d\d)/\1 hours \2 minutes \3 seconds/g"

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

There is no built-in function to do that so you'll have to do it manually.  Start with a simple replace:

| replace "+" with " days " in Total

For something a little more complex, try rex:

| rex field=Total "(?:(?<days>\d+)\+)?(?<hours>\d+):(?<minutes>\d+):(?<seconds>\d+)"
| eval Total = if(isnull(days),0,days)." days ".hours." hours ".minutes." minutes ".seconds." seconds"

 

---
If this reply helps you, Karma would be appreciated.

ITWhisperer
SplunkTrust
SplunkTrust

Split into two rex in case the duration is not more than 1 day.

| rex field=Total mode=sed "s/\+/ days /g"
| rex field=Total mode=sed "s/(\d\d):(\d\d):(\d\d)/\1 hours \2 minutes \3 seconds/g"
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...