Splunk Search

Calculating Average Time Span

capri1231
New Member

I am having problems calculating an average time span. I need to determine how log it takes for a technician to "acknowledge" a ticket when it is created by the Help Desk.

source="servername" Assignee="*" GroupName="TierII" OR GroupName="TierIII" 
| stats min(DateTimeAssign) AS begin max(DateTimeAcknow) AS end by CallID,GroupName,Assignee,Priority 
| eval duration=round(end-begin) | eval hours=duration/3600 | eval minutes=round(duration/60) 
| eval Created=strftime(begin," %b %d, %Y %T %p") 
| eval Closed=strftime(end," %b %d, %Y %T %p")
| chart avg(hours) values(CallID) values(Created) as Assigned values(Closed) as Ack values(minutes) over GroupName 
Tags (1)
0 Karma

lguinn2
Legend

Try this

source="servername" Assignee="*" GroupName="TierII" OR GroupName="TierIII" 
| stats min(DateTimeAssign) AS begin max(DateTimeAcknow) AS end by CallID,GroupName,Assignee,Priority 
| eval duration=round(end-begin) 
| eval Created=strftime(begin," %b %d, %Y %T %p") 
| eval Closed=strftime(end," %b %d, %Y %T %p")
| stats avg(duration) as avgDuration values(CallID) values(Created) as Assigned values(Closed) as Ack by GroupName
| fieldformat avgDuration = tostring(avgDuration,"duration")
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...