topic Re: Conver string to time duration. in Splunk Search

Conver string to time duration.

marquiselee — Thu, 10 Oct 2013 20:18:23 GMT

Hi I have logs where the media length/duration is displayed in a non standard format. anyone think this can be converted into seconds? *In some cases duration is reported as 0 too.

#   MEDIA ID   Duration

1       69911   1h 50mn
2       74454   1h 9mn
3       69910   1mn 58s
4       69909   59s 221ms
5       74453   17mn 4s
6       74452   2h 13mn
7       74451   0
8       74450   56s 134ms

Re: Conver string to time duration.

kristian_kolb — Thu, 10 Oct 2013 21:13:20 GMT

is this within a single event? And there are no timestamps, field extractions etc etc

Re: Conver string to time duration.

marquiselee — Fri, 11 Oct 2013 14:01:00 GMT

each mediaid is from a distinct xml log file that is indexed. I should note that duration is not from a transaction but rather from the xml file.

...| xmlkv | table "MEDIA ID" "Duration"

Re: Conver string to time duration.

richgalloway — Fri, 11 Oct 2013 16:06:07 GMT

I'm not sure exactly what you want to convert the duration into. Something like this will put it in hh:mm:ss format. Or you could drop the tostring() call and just display the secs field.

| rex field=Duration "((?<Hrs>.*?)hr)?\s?((?<Mins>.*?)mn)?\s?((?<Sec>.*?)s)?" | fillnull value=0 | eval secs=(Hrs*3600)+Mins*60+Sec | eval Time=tostring(secs, "duration") | table Duration, Time

Re: Conver string to time duration.

marquiselee — Fri, 11 Oct 2013 18:22:34 GMT

THANK YOU!!! this worked perfectly.