https://community.splunk.com/t5/Splunk-Search/Uptime-Conversion/m-p/555804#M157803 <P>That was the solution.&nbsp; &nbsp;Thanks</P> Tue, 15 Jun 2021 14:50:21 GMT cinsley 2021-06-15T14:50:21Z https://community.splunk.com/t5/Splunk-Search/Uptime-Conversion/m-p/555776#M157790 <P>Below is a two result conversion table.&nbsp; The data I am given, some will have days in the field and others will only have time.&nbsp; How do I setup a conversion to handle this situation.&nbsp; The convert auto(UpTime) works great as long as the field contains an entry with days.&nbsp; The rex works well, again as long as the field contains a string containing days.</P><P>| makeresults<BR />| eval UpTime="5:10:07:03.2419156"|append [|makeresults |eval UpTime="9:28:35.1006819"]<BR />| convert auto(UpTime) AS autoDays<BR />| rex field=UpTime "(?&lt;days&gt;\d+):(?&lt;hours&gt;\d+):(?&lt;minutes&gt;\d+):(?&lt;seconds&gt;\d+)\.(?&lt;micro&gt;\d+)"<BR />| table UpTime, autoDays, days,hours,minutes, seconds, micro</P><P>Results:</P><P>UpTime&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; autoDays&nbsp; days&nbsp; &nbsp; hours&nbsp; &nbsp;minutes seconds&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; micro&nbsp;</P><P>5:10:07:03.2419156&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 5&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;5&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;10&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;07&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 03&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 2419156<BR />9:28:35.1006819&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 9</P> Tue, 15 Jun 2021 12:35:06 GMT https://community.splunk.com/t5/Splunk-Search/Uptime-Conversion/m-p/555776#M157790 cinsley 2021-06-15T12:35:06Z https://community.splunk.com/t5/Splunk-Search/Uptime-Conversion/m-p/555778#M157792 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/222385">@cinsley</a>&nbsp;</P><P>Can you please try this?</P><LI-CODE lang="markup">| makeresults | eval UpTime="5:10:07:03.2419156"|append [|makeresults |eval UpTime="9:28:35.1006819"] | convert auto(UpTime) AS autoDays | rex field=UpTime "((?&lt;days&gt;\d+):)?(?&lt;hours&gt;\d+):(?&lt;minutes&gt;\d+):(?&lt;seconds&gt;\d+)\.(?&lt;micro&gt;\d+)" | table UpTime, autoDays, days,hours,minutes, seconds, micro</LI-CODE><P>&nbsp;</P><P>Thanks<BR />KV<BR />▄︻̷̿┻̿═━一<BR /><BR />If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.</P> Tue, 15 Jun 2021 13:06:11 GMT https://community.splunk.com/t5/Splunk-Search/Uptime-Conversion/m-p/555778#M157792 kamlesh_vaghela 2021-06-15T13:06:11Z https://community.splunk.com/t5/Splunk-Search/Uptime-Conversion/m-p/555804#M157803 <P>That was the solution.&nbsp; &nbsp;Thanks</P> Tue, 15 Jun 2021 14:50:21 GMT https://community.splunk.com/t5/Splunk-Search/Uptime-Conversion/m-p/555804#M157803 cinsley 2021-06-15T14:50:21Z https://community.splunk.com/t5/Splunk-Search/Uptime-Conversion/m-p/555807#M157805 Glad to help you<BR /><BR />Happy Splunking Tue, 15 Jun 2021 14:56:35 GMT https://community.splunk.com/t5/Splunk-Search/Uptime-Conversion/m-p/555807#M157805 kamlesh_vaghela 2021-06-15T14:56:35Z