Splunk Search

When using the transaction command, how do I format the duration into H:M:S?

clarksinthehill
Explorer

I'm sure this may have been asked before. When using transaction, I would like to format the duration into H:M:S, my search results for jobduration looks like 19 is being added to the result. Any help is appreciated.

Search is:

sourcetype=tws_merged (job_cpu_name ="cclita*" OR job_cpu_name ="cplisa3*" OR job_cpu_name = "cpaisa*f" OR job_cpu_name="lp0d7*") job_stream_name!="UNIXDLY" | transaction job_name host startswith"Jobman streamed" endswith="has completed SUCCESSFULLY" | eval Date=strftime(_time, "%m-%d-%y") | eval JobDuration=strftime(duration, "%H:%M:%S") | table Date job_name JobDuration

Sample Results:

02-03-16    ELSHPCST    02:56:52
02-04-16    ELVALRTD    19:00:00
02-04-16    ELVALRTPE   19:00:00
02-04-16    ELVALOOS    19:00:00
02-04-16    ELVALRTD    19:00:00
02-04-16    ELVALRTPE   19:00:00
0 Karma
1 Solution

javiergn
SplunkTrust
SplunkTrust

Use this instead:

| eval JobDuration = tostring(duration, "duration")

View solution in original post

0 Karma

javiergn
SplunkTrust
SplunkTrust

Use this instead:

| eval JobDuration = tostring(duration, "duration")
0 Karma

clarksinthehill
Explorer

Sure - it is.

sourcetype=tws_merged (job_cpu_name ="cclita*" OR job_cpu_name ="cplisa3*" OR job_cpu_name = "cpaisa*f" OR job_cpu_name="lp0d7*") job_stream_name!="UNIXDLY" 
 | transaction job_name host startswith"Jobman streamed" endswith="has completed SUCCESSFULLY" 
 | eval Date = strftime(_time, "%m-%d-%y") 
 | eval JobDuration = strftime(duration, "duration")
 | table Date, job_name,  JobDuration
0 Karma

javiergn
SplunkTrust
SplunkTrust

Ok, I can see the problem.
I made a mistake when I copied and pasted your code.

Instead of strftime you have to use the tostring function for JobDuration.

That is:

| eval JobDuration = tostring(duration, "duration")

Let me know if that helps. I have already fixed my two answers below.

clarksinthehill
Explorer

Perfect! Thanks for the help.

0 Karma

javiergn
SplunkTrust
SplunkTrust

No worries. If this is resolved please remember to mark is as answered so that others can benefit from it in the future.

0 Karma

clarksinthehill
Explorer

Thanks for the reply, using the above my results now include duration as a string. Any ideas?

02-05-16 ELINVPUB duration
02-05-16 ELLKPPARN duration
02-05-16 ELVALRTD duration
02-05-16 ELVALRTD duration

0 Karma

javiergn
SplunkTrust
SplunkTrust

Errrm, that shouldn't be the case unless your duration field is not a valid duration.
Can you post your whole query here?
Based on your comments it should be something like:

sourcetype=tws_merged (job_cpu_name ="cclita*" OR job_cpu_name ="cplisa3*" OR job_cpu_name = "cpaisa*f" OR job_cpu_name="lp0d7*") job_stream_name!="UNIXDLY" 
| transaction job_name host startswith"Jobman streamed" endswith="has completed SUCCESSFULLY" 
| eval Date = strftime(_time, "%m-%d-%y") 
| eval JobDuration = tostring(duration, "duration")
| table Date, job_name,  JobDuration
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...