Splunk Search

How to convert seconds to hours and minutes?

jfeitosa
Path Finder

How to convert the search results in seconds to hours and minutes?

This my search:

index=pan* (type=TRAFFIC AND vendor_action=allow) OR (type=THREAT AND vendor_action=alert) | eval MB=bytes/1024/1024  |transaction src_ip dest_ip startswith="start" endswith="end" | search eventcount>2 | stats values(sourcetype) as sourcetype, values(dest_hostname) as URL, sum(MB) as MB, sum(duration) as duration(Sec) by user |  table user URL MB duration(Sec)

alt text

Thank you in advance!

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Like this

index=pan* (type=TRAFFIC AND vendor_action=allow) OR (type=THREAT AND vendor_action=alert) | eval MB=bytes/1024/1024 |transaction src_ip dest_ip startswith="start" endswith="end" | search eventcount>2 | stats values(sourcetype) as sourcetype, values(dest_hostname) as URL, sum(MB) as MB, sum(duration) as duration(Sec) by user | table user URL MB duration(Sec) 
| eval "duration(Sec)"=tostring('duration(Sec)',"duration")

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Like this

index=pan* (type=TRAFFIC AND vendor_action=allow) OR (type=THREAT AND vendor_action=alert) | eval MB=bytes/1024/1024 |transaction src_ip dest_ip startswith="start" endswith="end" | search eventcount>2 | stats values(sourcetype) as sourcetype, values(dest_hostname) as URL, sum(MB) as MB, sum(duration) as duration(Sec) by user | table user URL MB duration(Sec) 
| eval "duration(Sec)"=tostring('duration(Sec)',"duration")

jfeitosa
Path Finder

alt text

Now I need the browsing team in each url, not the sum per user.
Como alterar a busca para trazer o tempo para cada url?

Search:

index=pan_logs (type=TRAFFIC AND vendor_action=allow) OR (type=THREAT AND vendor_action=alert) rule=URLF_LojaVirtual | eval MB=bytes/1024/1024  |transaction src_ip dest_ip startswith="start" endswith="end" | search eventcount>2 | stats values(dest_hostname) as URL, sum(duration) as duration(HH:MM:SS) by user |  table user URL duration(HH:MM:SS) | convert dur2sec(CallDuration) AS duration | eval "duration(HH:MM:SS)"=tostring('duration(HH:MM:SS)',"duration") | sort -duration(HH:MM:SS) | head 3

Tks

0 Karma

jfeitosa
Path Finder

Heck, that's right!

Thanks Somesoni2!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...