topic Re: How do I convert duration to minutes in Splunk Search

How do I convert duration to minutes

gill1723 — Tue, 29 Sep 2020 19:13:05 GMT

index=main host=10.247.82.1 user=* | rex field=duration "((?\d+)h:)?(?\d+)m:(?\d+)s" | eval duration=duration_second+60*duration_minute+3600*coalesce(duration_hour,0) | stats sum(duration) as total_duration by Username, date_month, date_mday | bin _time span=1d

Results:
date month total duration
april 24 2657

Re: How do I convert duration to minutes

p_gurav — Tue, 24 Apr 2018 18:18:00 GMT

Can you try something:

| convert dur2sec(duration) as duration_sec |eval min=duration_sec/60

Re: How do I convert duration to minutes

p_gurav — Tue, 24 Apr 2018 18:18:55 GMT

Also refer doc:
https://docs.splunk.com/Documentation/Splunk/7.0.3/SearchReference/Convert#1._Convert_sendmail_duration_fields_to_seconds

Re: How do I convert duration to minutes

gill1723 — Tue, 29 Sep 2020 19:13:18 GMT

Sorry I need to convert it to HH:MM:SS

Re: How do I convert duration to minutes

gill1723 — Tue, 29 Sep 2020 19:14:20 GMT

I need to convert this to HH:MM:SS

Re: How do I convert duration to minutes

richgalloway — Tue, 24 Apr 2018 18:46:42 GMT

Try this.

index=main host=10.247.82.1 user=* | rex field=duration "((?<duration_hour>\d+)h:)?(?<duration_minute>\d+)m:(?<duration_second>\d+)s" | eval duration=duration_second+60*duration_minute+3600*coalesce(duration_hour,0) | stats sum(duration) as total_duration by Username, date_month, date_mday | bin _time span=1d | eval total_duration=tostring(total_duration, "duration")

Re: How do I convert duration to minutes

gill1723 — Tue, 24 Apr 2018 18:51:19 GMT

I get this error when I run that script

⚠ Error in 'rex' command: Encountered the following error while compiling the regex '((?\d+)h:)?(?\d+)m:(?\d+)s': Regex: unrecognized character after (? or (?-

Re: How do I convert duration to minutes

richgalloway — Tue, 24 Apr 2018 19:17:19 GMT

That's because I copied the search after the forum munged it. I've corrected my answer.

Re: How do I convert duration to minutes

gill1723 — Tue, 24 Apr 2018 19:47:56 GMT

This works great thanks a bunch.

Re: How do I convert duration to minutes

rbansql104 — Fri, 15 Nov 2019 10:08:31 GMT

how can I declare a metrics in which I have the data like 30 days 10 hours 16 minutes have to be converted into seconds?