Splunk Search

How can I create duplicate events by duration hours?

Hanliamadeus
Explorer

Hello experts, I am working on a stats of meetings. 

As the attached photo shows, this meeting lasts for 7 (duration_hour) hours which starts at 8 AM (date_hour). I need to duplicate this event 7 times by adding 1 hour at date_hour with each time.

The final result I want is :

date_hour_timeThe rest fields
810/29/2020 8:00same
910/29/2020 9:00same
1010/29/2020 10:00same
1110/29/2020 11:00same
1210/29/2020 12:00same
1310/29/2020 13:00same
1410/30/2020 14:00same

 

Looking forward to your answers, thank you.

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults | eval duration_hour=7 | eval other="dummy"
| eval times=mvrange(_time, _time+(duration_hour * 60 * 60), "1h")
| mvexpand times
| eval _time=times

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults | eval duration_hour=7 | eval other="dummy"
| eval times=mvrange(_time, _time+(duration_hour * 60 * 60), "1h")
| mvexpand times
| eval _time=times
0 Karma

Hanliamadeus
Explorer

It works, thank you very much.

0 Karma
Get Updates on the Splunk Community!

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...