topic Convert duration time to number integer in Splunk Search

Convert duration time to number integer

Miguel3393 — Wed, 08 Jan 2025 23:17:12 GMT

I have this search, where I get the duration and I need to convert it to integer:
Example:

Min:Sec to Whole

00:02    to 1
00:16    to 1
01:53      to 2
09:20      to 10

...etc

Script:

index="cdr" | search "Call.TermParty.TrunkGroup.TrunkGroupId"="2811" OR "Call.TermParty.TrunkGroup.TrunkGroupId"="2810" "Call.ConnectTime"=* "Call.DisconnectTime"=* |lookup Pais Call.RoutingInfo.DestAddr OUTPUT Countrie | eval Disctime=strftime('Call.DisconnectTime'/1000,"%m/%d/%Y %H:%M:%S %Q") | eval Conntime=strftime('Call.ConnectTime'/1000, "%m/%d/%Y %H:%M:%S%Q") | eval diffTime=('Call.DisconnectTime'-'Call.ConnectTime') | eval Duracion=strftime(diffTime/1000, "%M:%S") | table Countrie, Duración Spain 00:02 Spain 00:16 Argentina 00:53 Spain 09:20 Spain 02:54 Spain 28:30 Spain 01:18 Spain 00:28 Spain 16:40 Spain 00:03 Chile 00:25 Uruguay 01:54 Spain 01:54

Regards.

Re: Convert duration time to number integer

isoutamo — Wed, 08 Jan 2025 21:32:20 GMT

How about ceil for diffTime?
https://docs.splunk.com/Documentation/Splunk/9.4.0/SearchReference/MathematicalFunctions#ceiling.28.26lt.3Bnum.26gt.3B.29_or_ceil.28.26lt.3Bnum.26gt.3B.29

Re: Convert duration time to number integer

gcusello — Thu, 09 Jan 2025 08:09:13 GMT

Hi @Miguel3393 ,

at first, don't use the search command after the main search because your search is slower!

Then, you already calculated the difference in seconds in the field diffTime, you have only to add this field to the table command.

then, I'm not sure that the solution to extress the duration in minutes and seconds is correct, you shuld use:

| eval Duracion=tostring(diffTime,"duration")

In other words, please try this:

index="cdr" ("Call.TermParty.TrunkGroup.TrunkGroupId"="2811" OR "Call.TermParty.TrunkGroup.TrunkGroupId"="2810") "Call.ConnectTime"=* "Call.DisconnectTime"=* | lookup Pais Call.RoutingInfo.DestAddr OUTPUT Countrie | eval Disctime=strftime('Call.DisconnectTime'/1000,"%m/%d/%Y %H:%M:%S %Q") | eval Conntime=strftime('Call.ConnectTime'/1000, "%m/%d/%Y %H:%M:%S%Q") | eval diffTime=('Call.DisconnectTime'-'Call.ConnectTime') | eval Duracion=tostring(diffTime,"duration") | table Countrie Duracion diffTime

Ciao.

Giuseppe

Re: Convert duration time to number integer

Miguel3393 — Thu, 09 Jan 2025 15:08:12 GMT

Thanks for the response @gcusello

This is the result I get with what you mention.

Regards.

Re: Convert duration time to number integer

gcusello — Thu, 09 Jan 2025 15:09:33 GMT

Hi @Miguel3393 ,

good for you, see next time!

let us know if we can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

Re: Convert duration time to number integer

bowesmana — Fri, 10 Jan 2025 00:47:09 GMT

If you want to get duration as whole rounded up minutes, use ceil, as @isoutamo shows, e.g.

| eval WholeMinutes=ceil(diffTime/1000/60)