Splunk Search

Average duration

DTERM
Contributor

What is the syntax to obtain the average duration for each severity type in a query? A field exists called app_duration=0d 0h 40m 3s. I need the average for each severity type.

Thanks.

Tags (1)
1 Solution

bwooden
Splunk Employee
Splunk Employee

First convert the app_duration to a format convert can use. Then, use convert to store app_duration in seconds. Next, average all seconds by severity_type. Finally, re-format avg_app_duration for each severity_type in the human readable format of HH:MM:SS.

eval app_duration=replace(replace(replace(app_duration,"d\s","+"),"h|m|s",""),"\s",":") 
| convert dur2sec(app_duration) 
| stats avg(app_duration) as avg_app_duration by severity_type 
| eval avg_app_duration=tostring(round(avg_app_duration,0),"duration")

View solution in original post

bwooden
Splunk Employee
Splunk Employee

First convert the app_duration to a format convert can use. Then, use convert to store app_duration in seconds. Next, average all seconds by severity_type. Finally, re-format avg_app_duration for each severity_type in the human readable format of HH:MM:SS.

eval app_duration=replace(replace(replace(app_duration,"d\s","+"),"h|m|s",""),"\s",":") 
| convert dur2sec(app_duration) 
| stats avg(app_duration) as avg_app_duration by severity_type 
| eval avg_app_duration=tostring(round(avg_app_duration,0),"duration")
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...