Hi Try this | makeresults | eval temp="7h13m17s, 4m6s" | makemv delim="," temp | mvexpand temp | rex field=temp "((?P<hour>\d+)h){0,1}(?P<minutes>\d+)m(?P<seconds>\d+)s" | eval minutes = if(isnotnull(hour),((hour*60)+minutes),minutes) | eval result = minutes.".".printf("%02d",seconds) |table temp, result ... View more

I think the issue is with your initial conversion. You say you are using %m-%d-%Y %H:%M:%S %p UTC to interpret your original timestamps, that is incorrect. Your timestamps don't have 24h clock, they have 12h clock + AM/PM. When you use %H I bet the %p (AM/PM) gets ignored. Use %m-%d-%Y %I:%M:%S %p UTC Also: it would help if you would post the actual search code that you are using, so we can see more accurately what you are doing. ... View more

This might work. I just used list instead of values and that did the trick. ... View more

| makeresults | eval _raw="{ \"Activity\": \"Logger\", \"ActivityResult\": \"success\", \"Application\": \"TestApp\", \"CorrelationId\": \"test_file.txt\", \"DestinationIp\": \"\", \"Level\": \"Info\", \"Logger\": \"TestApp\", \"Message\": { \"Message\": { \"PayLoad\": { \"generated\": \"2019-11-27T17:28:55.134008\", \"report\": { \"created\": \"2019-11-27 17:28:55.133 UTC\", \"failed\": 0, \"processed\": 46, \"succeed\": 46 } }, \"Status\": \"SUCCESS\" } }, \"Protocol\": \"TCP\", \"SourceIp\": \"\", \"ThreadId\": \"\", \"Timestamp\": \"2019-11-27 11:28:55.169200\", \"Type\": \"App\", \"UserId\": \"test\" }" | append [| makeresults | eval _raw="{ \"Activity\": \"Logger\", \"ActivityResult\": \"success\", \"Application\": \"TestApp\", \"CorrelationId\": \"test_file_1.txt\", \"DestinationIp\": \"\", \"Level\": \"Info\", \"Logger\": \"TestApp\", \"Message\": { \"Message\": { \"PayLoad\": { \"generated\": \"2019-11-27T17:28:55.134008\", \"failed\": 0, \"processed\": 46, \"succeed\": 46 }, \"Status\": \"SUCCESS\" } }, \"Protocol\": \"TCP\", \"SourceIp\": \"\", \"ThreadId\": \"\", \"Timestamp\": \"2019-11-27 11:28:55.169200\", \"Type\": \"App\", \"UserId\": \"test\" }"] | spath path=Message.Message.PayLoad.report output=payload1 | spath path=Message.Message.PayLoad output=payload2 | spath path=Message.Message.PayLoad.generated output=generated | eval payload=coalesce(payload1,payload2) | spath input=payload path=processed output=processed | spath input=payload path=failed output=failed | spath input=payload path=succeed output=succeed | table generated processed succeed failed Hi, spath is useful. ... View more

Like this: | makeresults | eval time="12:34:56.654321" | rename COMMENT AS "Everything above generates sample event data; everything below is your solution" | rex field=time "(?:(?:(?<duration_hours>\d+):)?(?<duration_minutes>\d+):)?(?<duration_seconds>.+)$" | fillnull value=0 duration_hours duration_minutes | eval duration = duration_seconds + (60 * (duration_minutes + (60 * duration_hours))) | fieldformat duration = tostring(duration, "duration") | fieldformat duration_in_minutes = duration / 60 ... View more

You can use timechart and specify a span of 1 minute. For example: <your search> | timechart count span=1m ... View more

Tried this chart values(ProcessingTime) as AvgTime by FileName it gives me results but the avgTime is 0 for all ... View more

No problem. Glad to help. For your other question look at the answer in the link below. Pretty much you'd need to convert your fields to epoch and calculate the difference from that. https://answers.splunk.com/answers/114818/find-the-difference-between-two-date-time-values.html ... View more

HJi @gravi, if there's a rule in the values of filename in the second search (e.g. take all but extension), you could use regex to extract them, something like this: index=index_A | join FileName [ search index=index_B | rex field=FileName "(?<FileName>.*)\.\w+$" ] | ... Ciao. Giuseppe ... View more

I have two options for you: Divide this into two separate events. This would however only works if you have an ID or something that would tie both events together. Create another field extraction to extract message1, timestamp1, message2, timestamp2 I would try the option 2 before as this would not require re-indexing data etc. Cheers ... View more

try this: index=<your_index> | rex "\/splunk\/(?<filename>[^\s]+)" If it's not working then please give more sample inputs. This solution is on the assumption that it always follows the path /splunk/filename ... View more

You can also use the split() eval command. | makeresults | eval sample="4 12 22 87 2" | eval sample=split(sample, " ") | mvexpand sample ... View more