https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-convert-values-in-seconds-to-days-hours/m-p/363112#M107264 <P>i have values with seconds so i need to convert those into days, hours, minutes, seconds, and milliseconds. i am using this search but am getting 1 day extra. </P> <PRE><CODE>eval DurationReq_Resp=strftime(DurationReq_Resp, "%d day %Hh:%Mmin:%Ss.%3Nms") </CODE></PRE> <P>Can you please help me in this?<BR /> Thanks.</P> Tue, 21 Mar 2017 16:50:32 GMT prashanthberam 2017-03-21T16:50:32Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-convert-values-in-seconds-to-days-hours/m-p/363112#M107264 <P>i have values with seconds so i need to convert those into days, hours, minutes, seconds, and milliseconds. i am using this search but am getting 1 day extra. </P> <PRE><CODE>eval DurationReq_Resp=strftime(DurationReq_Resp, "%d day %Hh:%Mmin:%Ss.%3Nms") </CODE></PRE> <P>Can you please help me in this?<BR /> Thanks.</P> Tue, 21 Mar 2017 16:50:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-convert-values-in-seconds-to-days-hours/m-p/363112#M107264 prashanthberam 2017-03-21T16:50:32Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-convert-values-in-seconds-to-days-hours/m-p/363113#M107265 <P>Any partial days count as days, and negative durations are errors, so you basically can't mix days and hour/min/second in the same strftime and get a valid result. Calculate the number of days separately and concatenate.</P> <PRE><CODE>| eval DurationReq_Resp=floor(DurationReq_Resp/86400)." day ".strftime(DurationReq_Resp, "%Hh:%Mmin:%Ss.%3Nms") </CODE></PRE> Tue, 21 Mar 2017 17:25:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-convert-values-in-seconds-to-days-hours/m-p/363113#M107265 DalJeanis 2017-03-21T17:25:01Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-convert-values-in-seconds-to-days-hours/m-p/363114#M107266 <P>%d is the day of the month, so strftime might be getting confused. Try something like this:</P> <PRE><CODE>| eval DurationReq_Resp=tostring(DurationReq_Resp,"DurationReq_Resp") | eval DurationReq_RespMS=strftime(DurationReq_Resp,".%3N") | rex field=DurationReq_Resp mode=sed "s/\+/ days /" | rex field=DurationReq_Resp mode=sed "s/\d\:{1}/h:/" | rex field=DurationReq_Resp mode=sed "s/\d\:{1}/min:/" | rex field=DurationReq_Resp mode=sed "s/$/s/" | rex field=DurationReq_RespMS mode=sed "s/$/Ms/" | eval DurationReq_Resp=DurationReq_Resp+""+DurationReq_RespMS </CODE></PRE> <P>it's a little lengthy, but i think it'll work for you.</P> Tue, 21 Mar 2017 17:40:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-convert-values-in-seconds-to-days-hours/m-p/363114#M107266 cmerriman 2017-03-21T17:40:59Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-convert-values-in-seconds-to-days-hours/m-p/363115#M107267 <P>i think we need to calculate the hours also in this same way..</P> Tue, 21 Mar 2017 17:56:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-convert-values-in-seconds-to-days-hours/m-p/363115#M107267 prashanthberam 2017-03-21T17:56:25Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-convert-values-in-seconds-to-days-hours/m-p/363116#M107268 <P>Like this:</P> <PRE><CODE>eval DurationReq_Resp=tostring(DurationReq_Resp, "duration") </CODE></PRE> Tue, 21 Mar 2017 18:39:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-convert-values-in-seconds-to-days-hours/m-p/363116#M107268 woodcock 2017-03-21T18:39:16Z