topic How do I convert a time duration to a number? in Splunk Search

How do I convert a time duration to a number?

kranthimutyala — Wed, 21 Sep 2022 14:09:59 GMT

Hi Team,

I have a field which has the values in the below string format: HH:MM:SS.3N

0:00:43.096

22:09:50.174

1:59:54.382

5:41:21.623

0:01:56.597

I want to convert the whole duration into minutes and anything under a min is considered 1 minute

Re: Convert a time duration to a number

gcusello — Wed, 21 Sep 2022 06:33:36 GMT

Hi @kranthimutyala,

you have to extract the hours value using a regex and then use an eval, something like this:

<your_search> | rex field=your_duration "^(?<hours>\d+):(?<minutes>\d+):(?<seconds>\d+)\.(?<milliseconds>\d+)" | eval duration_in_minutes=hours*60+minutes+if(seconds>0 OR milliseconds>0,1,0) | table duration_in_minutes

Ciao.

Giuseppe

Re: Convert a time duration to a number

gcusello — Thu, 22 Sep 2022 13:57:47 GMT

Hi @kranthimutyala,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Re: Convert a time duration to a number

kranthimutyala — Fri, 23 Sep 2022 12:20:26 GMT

Karma and given, one more question from my end which can earn you more
https://community.splunk.com/t5/Splunk-Search/Help-with-extracting-JSON-fields/m-p/614290#M213452