topic Re: Time format for identifying processing rate in Getting Data In

Time format for identifying processing rate

msbhatmam — Tue, 13 Oct 2015 01:49:47 GMT

I am trying to get some details from my event text which has the record count and also the processing time. I want to find the processing rate.I.e records/processing time. I could find that the processing time
Is like 1.2s where s is seconds. Sometimes its like 567ms where ms is milliseconds or 1h2m.0030s where h m and s are hours minutes and second respectively.

Is there any function which can help me to convert it all into either ms
or seconds. Or could could you please suggest how I could change it into a unified format like seconds ?

As I am stuck with critical deliverable need your inputs as soon as possible 😞

Re: Time format for identifying processing rate

somesoni2 — Tue, 13 Oct 2015 16:38:44 GMT

See if this is similar to your problem.
https://answers.splunk.com/answers/128981/converting-duration-field-value-to-seconds.html

Re: Time format for identifying processing rate

woodcock — Tue, 13 Oct 2015 17:55:42 GMT

Like this:

 ... | eval durationSeconds =coalesce(strptime(fieldname, "%Hh%Mm%S.%Ns"), strptime(fieldname, "%Nms"))

You may need to add more pieces to the coalesce to accommodate other alternate formats.