topic convert text into numbers - HH:MM:SS into minutes in Splunk Search

convert text into numbers - HH:MM:SS into minutes

splunker30039 — Thu, 29 Jul 2010 03:00:29 GMT

I have a field 'vpn_duration' which is taken from the 'Duration:' value in an ASA syslog disconnect message.

The message looks like this:

May 26 15:15:56 cvpn.X.net May 26 2010 14:58:24: %ASA-4-113019: Group = XVPN, Username = userA, IP = 1.2.3.4, Session disconnected. Session Type: IPsec, Duration: 5h:06m:18s, Bytes xmt: 24875, Bytes rcv: 33036, Reason: Lost Service

I would like to take the value I get (5h:06m:18s) and convert it into minutes. So, in this case, my result would be 306.

How can I get this done?

Re: convert text into numbers - HH:MM:SS into minutes

ftk — Thu, 29 Jul 2010 03:12:55 GMT

You can use something like the following search:

your search terms | rex "Duration: (?<hours>\d+)h:(?<minutes>\d+)m:(?<seconds>\d+)s" | eval duration_minutes = ((hours*60)+minutes+(seconds/60))

Re: convert text into numbers - HH:MM:SS into minutes

dwaddle — Thu, 29 Jul 2010 03:22:59 GMT

I came up with almost the same thing as ftk, except my ASA has durations > 1d in the logs..

| rex field="_raw" "Duration: (?&lt;dur_day&gt;[0-9]+)?d? *(?&lt;dur_hour&gt;[0-9]+)h?:(?&lt;dur_min&gt;[0-9]+)m?" 
| eval connduration=(if(dur_day=="",0,dur_day)*1440)+(dur_hour * 60)+dur_min