topic How to convert time secs into HH:MM format? in Splunk Search

How to convert time secs into HH:MM format?

sekhar463 — Wed, 04 Jan 2023 16:19:30 GMT

Hai All,

from the below search how to convert secs to HH:MM format

age fields is getting time in secs

Re: how to convert time secs into HH:MM format

gcusello — Wed, 04 Jan 2023 14:53:16 GMT

Hi @sekhar463,

you can use eval tostring:

Ciao.

Giuseppe

Re: How to convert time secs into HH:MM format?

sekhar463 — Fri, 06 Jan 2023 13:11:55 GMT

Hi Thanks,

this query i am using for to get UF status

but query taking long time if i am trying to filter status =DOWN

how we can modify this search fasten this query or how we can take time frame to get results

Re: How to convert time secs into HH:MM format?

gcusello — Sat, 07 Jan 2023 10:13:36 GMT

Hi @sekhar463,

if your search is slow there could be two issues:

very many data,
you're using a slow storage.

for the first issue, you can accelerate your search in many ways, e.g. using a summary index.

For the second issue, remember that storage is the bottleneck of each Splunk system, and Splunk requires at least 800 (better 1200) IOPS for Hot and Warm Buckets, so the only solution is to use a faster storage.

Ciao.

Giuseppe