topic Re: How to convert string time to seconds in Splunk Search

How to convert string time to seconds

sashib — Tue, 13 Jul 2021 05:59:56 GMT

I have a TimeField with data format is like 4 Days 14 Hours 40 Minutes and sometimes 7 Hours 40 Minutes

TimeField

4 Days 14 Hours 40 Minutes

7 Hours 40 Minutes

40 Minutes

I want to convert this field values into seconds so that i can sort my data based on time.

Thanks!

Re: How to convert string time to seconds

bowesmana — Tue, 13 Jul 2021 06:05:51 GMT

This search sets up your data example then calculates the seconds.

See from the rex statement onwards

Re: How to convert string time to seconds

sashib — Tue, 13 Jul 2021 07:02:01 GMT

@bowesmana

I tried your suggestion,

TimeField	days	hours	minutes	secs
4 Days 14 Hours 40 Minutes	4	0	0	345600
6 Hours 20 Minutes	0	6	0	21600

for the first entry giving only days

and for second entry its giving only hours

Thank you!

Re: How to convert string time to seconds

kamlesh_vaghela — Tue, 13 Jul 2021 07:14:44 GMT

@sashib

Can you please try this?

YOOUR_SEARCH | rex field=TimeField "(((?<Days>\d.*)\sDays\s)?(?<Hours>\d.*)\sHours\s)?(?<Minutes>\d.*)\sMinutes" | fillnull value=0 | eval secs=(Days*86400)+(Hours*3600)+(Minutes*60)

My Sample Search :

| makeresults | eval _raw="TimeField 4 Days 14 Hours 40 Minutes 7 Hours 40 Minutes 40 Minutes" | multikv forceheader=1 | rex field=TimeField "(((?<Days>\d.*)\sDays\s)?(?<Hours>\d.*)\sHours\s)?(?<Minutes>\d.*)\sMinutes" | fillnull value=0 | eval secs=(Days*86400)+(Hours*3600)+(Minutes*60)

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.