topic Re: Convert seconds in days, hours and minutes in Splunk Search

Convert seconds in days, hours and minutes?

simon_b — Tue, 15 Nov 2022 13:53:46 GMT

Hi, i have a duration in seconds and want to convert it to days, hours and minutes. The additional seconds should be just cut off in the output. Ideally there should be no leading zeros (not "04 hours" but "4 hours") and if days, hours or minutes is 0 they should not be displayed in the output.

Examples:

Duration in seconds	Output
14400	"4 hours"
14432	"4 hours"
604800	"7 days"
1800	"30 minutes"
108002	"1 day 6 hours"

Re: Convert seconds in days, hours and minutes

bowesmana — Tue, 15 Nov 2022 09:20:15 GMT

This example

| makeresults | eval _raw="Duration in seconds Output 14400 4 hours 14432 4 hours 604800 7 days 1800 30 minutes 108002 1 day 6 hours" | multikv forceheader=1 | table Dur* Ou* ``` Calculation ``` | eval days=floor(Duration_in_seconds/86400), days=if(days>0, days." days", "") | eval remain=Duration_in_seconds % 86400 | eval hours=floor(remain/3600), hours=if(hours>0, hours." hours", "") | eval remain=remain % 3600 | eval minutes=floor(remain/60), minutes=if(minutes>0, minutes." minutes", "") | eval NewOutput=trim(printf("%s %s %s", days, hours, minutes)) | table Duration_in_seconds Output NewOutput

The first part sets up the example data - use the SPL following the Calculation comment

You could also replace all the eval statements following the Calculation with the following that will do the same

| eval remain=Duration_in_seconds, NewOutput="", n=0, types=split("days,hours,minutes",",") | foreach 86400 3600 60 [ eval t=floor(remain/<<FIELD>>), NewOutput=NewOutput.(if(t>0, " ".t." ".mvindex(types, n), "")), remain=remain % <<FIELD>>, n=n+1 ] | table Duration_in_seconds Output NewOutput

Note that this example causes the field name to be Duration_in_seconds with _ character instead of space

Re: Convert seconds in days, hours and minutes

gcusello — Tue, 15 Nov 2022 09:23:50 GMT

Hi @simon_b,

the easiest way is to use the tostring function:

| eval duration=tostring(duration,"duration")

if yu don't like the output format, you can convert using an eval calculation:

| eval days=if(duration>86400,round(duration/86400,0),""), hours=if(duration>3600,round(duration-days*86400,0),""), minutes=if(duration>60,round(duration-days*86400-hours*3600,0),""), seconds=duration-days*86400-hours*3600-minutes*60 | eval Output=days.if(days>0," days ","").hours.if(hours>0," hours ","").minutes.if(minutes>0," minutes ","").seconds." seconds"

Ciao.

Giuseppe

Re: Convert seconds in days, hours and minutes

nuaraujo — Thu, 07 Sep 2023 20:09:46 GMT

Hi @gcusello ,

I used your logic, but with a small change in the function used. (floor instead or round).

Would this make more sense to you?

| eval duration=round((now() - last_seen),0) | eval days=if(duration>86400,floor(duration/86400),"0"), hours=if(duration>3600,floor((duration-days*86400)/3600),"0"), minutes=if(duration>60,floor((duration-days*86400-hours*3600)/60),"0"), seconds=duration-days*86400-hours*3600-minutes*60 | eval Output=days.if(days>0," days ","").hours.if(hours>0," hours ","").minutes.if(minutes>0," minutes ","").seconds." seconds"