topic Re: Convert seconds to MM:SS.ms in Splunk Search

Convert seconds to MM:SS.ms

splunk_learner — Mon, 07 Oct 2013 11:43:05 GMT

Hi
I am trying to convert seconds.milliseconds for ex 4.6566, 0.55,1.2 to Minutes:Second.milliseconds format
I tried tostring(time,duration) but it returns Days:hours:minutes:seconds
Please help

Re: Convert seconds to MM:SS.ms

MuS — Mon, 07 Oct 2013 12:00:50 GMT

Hi splunk_learner

try something like this:

... | eval n=strftime(timeStr, "%M:%S.%N")

This example returns the minute, seconds and subseconds from the timeStr field.
See the docs on Commontimeformatvariables for more information on the time format.

update:

just learned that strptime is for time stamp parsing, where strftime is for time stamp formatting.

hope this helps...

cheers, MuS

Re: Convert seconds to MM:SS.ms

sowings — Mon, 07 Oct 2013 12:44:31 GMT

Did you mean strftime? Also, the latter will interpret timestr as # of seconds since the Unix epoch. While for times < 1 hour (3600 sec) it works just fine, when you start showing the hour, it may deliver confusing results (e.g. in my time zone, I get "16:00:05.12" for an input of "5.12").

Re: Convert seconds to MM:SS.ms

MuS — Mon, 07 Oct 2013 12:51:10 GMT

no strftime takes epochtime as input as were strptime takes a time represented by a string....but now after some testing it looks like strptime isn't working either 😞

Re: Convert seconds to MM:SS.ms

sowings — Mon, 07 Oct 2013 13:11:53 GMT

The OP indicated that they have seconds.milli and wanted a nice human-readable string. Sounds like they want strftime (with caveats).

Re: Convert seconds to MM:SS.ms

MuS — Mon, 07 Oct 2013 13:16:38 GMT

a reverted convert mstime() would be the perfect match here

Re: Convert seconds to MM:SS.ms

twinspop — Mon, 07 Oct 2013 14:20:36 GMT

MuS was right there, just one change: Use strftime instead of strptime.

| eval test=4.678 | eval str=strftime(test,"%M:%S.%N")

str returned as "00:04.678000000"