topic Re: event with time record in Getting Data In

event with time record

benji00 — Thu, 11 Jul 2019 13:04:36 GMT

Hello,

I have a field containing an execution time looking like: 100s and which is corresponding to 100 seconds.
The field is only in second, so my concern is only to remove the final S to have a field with only numbers, any idea about how to do?

Regards,

Re: event with time record

renjith_nair — Thu, 11 Jul 2019 13:14:53 GMT

@benji00 ,

Try

|rex field=execution_time "(?<sec>\d+)"

where execution_time is your field name

Re: event with time record

benji00 — Thu, 11 Jul 2019 13:52:03 GMT

@renjith.nair,
OK but then how can I call my filtered out field?
Because at the end I want to use it to calculate a difference with another sub-process execution time (already conatining only numbers)...

Re: event with time record

renjith_nair — Thu, 11 Jul 2019 14:00:54 GMT

@benji00 ,
The seconds will be in the field sec . You may use any other field name

See this run anywhere example

|makeresults|eval execution_time="100s"|rex field=execution_time "(?<seconds>\d+)"|fields execution_time,seconds

Re: event with time record

benji00 — Fri, 12 Jul 2019 08:17:35 GMT

Thanks... it is working as expected (y)