Splunk Search

tostring (X, "duration") working wierd.

sarumjanuch
Path Finder

Why when i am using this function for big seconds values, i get something like: "1+06:29:32"? If this field is duration then i suspect it can have more than 24 hours. Can someone explain?

sideview
SplunkTrust
SplunkTrust

That string value is saying "1 day, 6 hours, 29 minutes and 32 seconds".

If you give it a value less than one day, it'll just give a more familiar: "12:30:00" meaning 12 hours and thirty minutes.

On the other hand if you give it a really really enormous value, as in this artificial search:

 | stats count | eval foo=2334121312412 | eval duration=tostring(foo,"duration")

It'll happily tell you "27015292+23:13:32 ", ie 27 million days and change.

UPDATE:

I see. If you'd prefer it to say 160:25:30 instead of 6+16:25:30, then you can use some pretty hairy eval syntax:

| eval durationStr=tostring(floor(duration/(3600))) + ":" + mvjoin(mvindex(split(tostring(duration,"duration"),":"),1,4),":")

What this does, is it manually calculates the hours on one side. On the other side it lets the tostring function do its thing, but then it clips off the left side leaving only the minutes and seconds. Glue them back together and voila.

Or if you'd prefer to do it all manually with arithmetic operators and the mod operator (%), you can do that too:

| eval durationStr=tostring(floor(duration/(3600))) + ":" + tostring(floor(duration/(60)) % 60) + ":" + tostring(duration % 60)

You probably want to save this as a macro so you can use it like

| `get_string_duration(duration)`

sideview
SplunkTrust
SplunkTrust

Gotcha. I updated my answer. That's possible too although it's more manual.

jwalzerpitt
Influencer

Is there anyway to show just the hours and minutes for the duration (jettisoning the second, etc)?

I found a link here - http://answers.splunk.com/answers/97381/session-duration-in-minutes.html - which shows how to "pretty" the output, but not having luck trying to modify the query string you provided with the one provided int he link:

rename "Avg Session Duration(minutes)" AS avgSessionDuration
| eval pretty_AvgSessionDuration = floor(avgSessionDuration/60)." Hours ".floor(floor(avgSessionDuration - (avgSessionDuration/60))/60)." Min"

Thx

0 Karma

sarumjanuch
Path Finder

Yeah, i understand this, but for examle i have CDR's application and i need to count total duration of calls, and this will be very wierd if i will post my calls duration something like this, is there any way to get this in absolute values?? for example: "160:25:30"

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...