https://community.splunk.com/t5/Splunk-Search/Help-with-dur2sec-function-not-displaying/m-p/479898#M134502 <P>Hi<BR /> I am having an issue with the result of my dur2sec function not displaying.<BR /> Here is the SPL. I am still new to splunk so have put what I believe I am doing alongside the query. </P> <P>|eval Entrytimestamp=strptime(ENTRY, "%d.%m.%Y %H:%M:%S") -- convert the ENTRY field date string to a proper date format <BR /> |eval dwellTime_S = tostring(now()-Entrytimestamp,"duration") -- get the duration string and assign it to variable dwellTime_S<BR /> |convert dur2sec(dwellTime_S) AS dwellTime_C -- convert the dwellTime string variable to seconds and assign to dwellTime_C variable</P> <P>When i then use the dwellTime_C in a table the column is blank. Please can anyone help and advise where I am going wrong ?</P> <P>Many Thanks</P> <P>PS: I am not in the office tomorrow so wont be able to reply immediately.</P> Wed, 30 Sep 2020 02:10:33 GMT PBerry7538 2020-09-30T02:10:33Z https://community.splunk.com/t5/Splunk-Search/Help-with-dur2sec-function-not-displaying/m-p/479898#M134502 <P>Hi<BR /> I am having an issue with the result of my dur2sec function not displaying.<BR /> Here is the SPL. I am still new to splunk so have put what I believe I am doing alongside the query. </P> <P>|eval Entrytimestamp=strptime(ENTRY, "%d.%m.%Y %H:%M:%S") -- convert the ENTRY field date string to a proper date format <BR /> |eval dwellTime_S = tostring(now()-Entrytimestamp,"duration") -- get the duration string and assign it to variable dwellTime_S<BR /> |convert dur2sec(dwellTime_S) AS dwellTime_C -- convert the dwellTime string variable to seconds and assign to dwellTime_C variable</P> <P>When i then use the dwellTime_C in a table the column is blank. Please can anyone help and advise where I am going wrong ?</P> <P>Many Thanks</P> <P>PS: I am not in the office tomorrow so wont be able to reply immediately.</P> Wed, 30 Sep 2020 02:10:33 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-dur2sec-function-not-displaying/m-p/479898#M134502 PBerry7538 2020-09-30T02:10:33Z https://community.splunk.com/t5/Splunk-Search/Help-with-dur2sec-function-not-displaying/m-p/479899#M134503 <P>Why not skip the middle step? <CODE>now()-Entrytimestamp</CODE> is in seconds so there's no need to convert.</P> <PRE><CODE>| eval Entrytimestamp=strptime(ENTRY, "%d.%m.%Y %H:%M:%S") | eval dwellTime_C = now()-Entrytimestamp | eval dwellTime_S = tostring(dwellTime_C, "duration") </CODE></PRE> Thu, 12 Sep 2019 00:27:47 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-dur2sec-function-not-displaying/m-p/479899#M134503 richgalloway 2019-09-12T00:27:47Z https://community.splunk.com/t5/Splunk-Search/Help-with-dur2sec-function-not-displaying/m-p/479900#M134504 <P>Thanks Rich </P> Fri, 13 Sep 2019 09:34:30 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-dur2sec-function-not-displaying/m-p/479900#M134504 PBerry7538 2019-09-13T09:34:30Z