https://community.splunk.com/t5/Getting-Data-In/convert-verbose-human-readble-time-to-splunktime/m-p/191061#M38040 <P>ok, so (for now) i do this:</P> <P>index="jira_summary" project="xxxxx" status!="Closed" aggregatetimespent=* | eval age=aggregatetimespent | eval minutes = if(match(age, "minute"), replace(age, ".<EM>?(\d+)\sminute.</EM>", "\1"), 0) | eval hours = if(match(age, "hour"), replace(age, ".<EM>?(\d+)\shour.</EM>", "\1"), 0) | eval days = if(match(age, "day"), replace(age, ".<EM>?(\d+)\s*day.</EM>", "\1"), 0) | eval age_seconds = minutes*60 + hours*3600 + days*86400 | sort age_seconds | eval timespent=tostring(age_seconds,"duration")| table title,assignee,timespent</P> <P>the "timespent" is not sortable so i use the temp field.</P> Mon, 28 Sep 2020 15:32:59 GMT dominiquevocat 2020-09-28T15:32:59Z https://community.splunk.com/t5/Getting-Data-In/convert-verbose-human-readble-time-to-splunktime/m-p/191059#M38038 <P>Hi, i got some results that contain a arbitrary amount of time (from Jira) that has a human readable structure which i would however like to convert to a splunk timespan so i can sort results.</P> <P>example strings would be:<BR /> 6 hours, 17 minutes<BR /> 20 minutes<BR /> 1 day, 1 hour, 20 minutes<BR /> 5 hours, 10 minutes<BR /> 1 day, 1 hour, 19 minutes<BR /> 6 hours, 30 minutes<BR /> 7 hours, 31 minutes<BR /> 6 hours, 2 minutes<BR /> 5 hours, 55 minutes<BR /> 45 minutes</P> <P>could potentially contain weeks, months etc...</P> <P>How would i best convert it so i can sort the value or chart results based on percentage of total of all values etc...</P> Fri, 27 Dec 2013 14:12:33 GMT https://community.splunk.com/t5/Getting-Data-In/convert-verbose-human-readble-time-to-splunktime/m-p/191059#M38038 dominiquevocat 2013-12-27T14:12:33Z https://community.splunk.com/t5/Getting-Data-In/convert-verbose-human-readble-time-to-splunktime/m-p/191060#M38039 <P>If you really have no way of getting a machine-readable representation of the age, you can roll your own parsing of this using regular expressions. Here's a start using minutes, hours, and days only:</P> <PRE><CODE>| stats count | eval age = "1 day, 1 hour, 20 minutes" | eval minutes = if(match(age, "minute"), replace(age, ".*?(\d+)\sminute.*", "\1"), 0) | eval hours = if(match(age, "hour"), replace(age, ".*?(\d+)\shour.*", "\1"), 0) | eval days = if(match(age, "day"), replace(age, ".*?(\d+)\s*day.*", "\1"), 0) | eval age_seconds = minutes*60 + hours*3600 + days*86400 </CODE></PRE> <P>You can extend that to include any unit you need, and move some of that to macros (maybe even passing the unit as a parameter to a generic macro) to clean up the clutter.</P> Fri, 27 Dec 2013 14:25:38 GMT https://community.splunk.com/t5/Getting-Data-In/convert-verbose-human-readble-time-to-splunktime/m-p/191060#M38039 martin_mueller 2013-12-27T14:25:38Z https://community.splunk.com/t5/Getting-Data-In/convert-verbose-human-readble-time-to-splunktime/m-p/191061#M38040 <P>ok, so (for now) i do this:</P> <P>index="jira_summary" project="xxxxx" status!="Closed" aggregatetimespent=* | eval age=aggregatetimespent | eval minutes = if(match(age, "minute"), replace(age, ".<EM>?(\d+)\sminute.</EM>", "\1"), 0) | eval hours = if(match(age, "hour"), replace(age, ".<EM>?(\d+)\shour.</EM>", "\1"), 0) | eval days = if(match(age, "day"), replace(age, ".<EM>?(\d+)\s*day.</EM>", "\1"), 0) | eval age_seconds = minutes*60 + hours*3600 + days*86400 | sort age_seconds | eval timespent=tostring(age_seconds,"duration")| table title,assignee,timespent</P> <P>the "timespent" is not sortable so i use the temp field.</P> Mon, 28 Sep 2020 15:32:59 GMT https://community.splunk.com/t5/Getting-Data-In/convert-verbose-human-readble-time-to-splunktime/m-p/191061#M38040 dominiquevocat 2020-09-28T15:32:59Z