How to convert the search results in seconds to hours and minutes?
This my search:
index=pan* (type=TRAFFIC AND vendor_action=allow) OR (type=THREAT AND vendor_action=alert) | eval MB=bytes/1024/1024 |transaction src_ip dest_ip startswith="start" endswith="end" | search eventcount>2 | stats values(sourcetype) as sourcetype, values(dest_hostname) as URL, sum(MB) as MB, sum(duration) as duration(Sec) by user | table user URL MB duration(Sec)
Thank you in advance!
Like this
index=pan* (type=TRAFFIC AND vendor_action=allow) OR (type=THREAT AND vendor_action=alert) | eval MB=bytes/1024/1024 |transaction src_ip dest_ip startswith="start" endswith="end" | search eventcount>2 | stats values(sourcetype) as sourcetype, values(dest_hostname) as URL, sum(MB) as MB, sum(duration) as duration(Sec) by user | table user URL MB duration(Sec)
| eval "duration(Sec)"=tostring('duration(Sec)',"duration")
Like this
index=pan* (type=TRAFFIC AND vendor_action=allow) OR (type=THREAT AND vendor_action=alert) | eval MB=bytes/1024/1024 |transaction src_ip dest_ip startswith="start" endswith="end" | search eventcount>2 | stats values(sourcetype) as sourcetype, values(dest_hostname) as URL, sum(MB) as MB, sum(duration) as duration(Sec) by user | table user URL MB duration(Sec)
| eval "duration(Sec)"=tostring('duration(Sec)',"duration")
Now I need the browsing team in each url, not the sum per user.
Como alterar a busca para trazer o tempo para cada url?
Search:
index=pan_logs (type=TRAFFIC AND vendor_action=allow) OR (type=THREAT AND vendor_action=alert) rule=URLF_LojaVirtual | eval MB=bytes/1024/1024 |transaction src_ip dest_ip startswith="start" endswith="end" | search eventcount>2 | stats values(dest_hostname) as URL, sum(duration) as duration(HH:MM:SS) by user | table user URL duration(HH:MM:SS) | convert dur2sec(CallDuration) AS duration | eval "duration(HH:MM:SS)"=tostring('duration(HH:MM:SS)',"duration") | sort -duration(HH:MM:SS) | head 3
Tks
Heck, that's right!
Thanks Somesoni2!