Convert Seconds output to HH:MM:SS Format

itsmevic — Tue, 05 Jan 2021 23:12:01 GMT

I'd like to convert the output of the below SPL to reflect HH:MM:SS rather than just seconds. Any help is greatly appreciated!

index=* host=* user="username" sourcetype="WinEventLog:Security" EventCode="4624" OR EventCode=4634 | transaction user maxevents=2 startswith="EventCode=4624" endswith="EventCode=4634" maxspan=-1 | eval Logontime=if(EventCode="4624",_time,null()) | eval Logofftime=Logontime+duration | convert ctime(Logontime) as Logontime | convert ctime(Logofftime) as Logofftime | table host, src_nt_host, user, Logontime, Logofftime, duration | sort user, host, -duration | rename duration AS "Duration (seconds)"

Re: Convert Seconds output to HH:MM:SS Format

renjith_nair — Wed, 06 Jan 2021 02:22:09 GMT

Try

|eval hh_mm_ss=tostring(duration,"duration")

topic Re: Convert Seconds output to HH:MM:SS Format in Splunk Enterprise

Convert Seconds output to HH:MM:SS Format

Re: Convert Seconds output to HH:MM:SS Format