topic Re: Converting Duration Field value to seconds in Splunk Search

Converting Duration Field value to seconds

adityapavan18 — Thu, 27 Mar 2014 11:24:00 GMT

I have a extracted field call CallDuration and in logs it in format

%H:%M:%S.%2N like 00:00:38.60

That means the call duartion was 38.60 secs.

Now how can i convert that duartion to total number of seconds.??

If field value is 01:05:45.20
The new field should hold total duration in seconds ie. 3945.20sec

Re: Converting Duration Field value to seconds

richgalloway — Thu, 27 Mar 2014 12:07:18 GMT

Here's something to get you started:

eval duration=strptime(CallDuration,"%H:%M:%S.%2N") | eval base=strptime("00:00:00.00","%H:%M:%S.%2N") | eval secs=duration-base | table duration, secs

Re: Converting Duration Field value to seconds

MuS — Thu, 27 Mar 2014 12:18:31 GMT

Hi adityapavan18,

the following searchFu are example and you need to match them to your events, but you could do something like this:

... | rex field="_raw" "CallDuration: (?<hours>\d+)h:(?<minutes>\d+)m:(?<seconds>\d+)s" | eval CallDurationInSeconds = ((hours*60*60)+(minutes*60)+(seconds))

or something like this if you have duration over or under one day:

... | rex field="_raw" "CallDuration: (?<dur_day>[0-9]+)?d? *(?<dur_hour>[0-9]+)h?:(?<dur_min>[0-9]+)m?" | eval connduration=(if(dur_day=="",0,dur_day)*1440*60)+(dur_hour * 60*60)+(dur_min*60)

hope this helps ...

cheers, MuS

Re: Converting Duration Field value to seconds

MuS — Thu, 27 Mar 2014 12:20:34 GMT

that's a nice one as well and I was typing for to long 🙂

Re: Converting Duration Field value to seconds

somesoni2 — Thu, 27 Mar 2014 13:49:13 GMT

If you have many places where this conversion will take place, I would suggest to create a macro for it.

Re: Converting Duration Field value to seconds

gpullis — Wed, 10 Jun 2015 20:47:02 GMT

There's now a convert function for this:

... | convert dur2sec(CallDuration) AS duration

Re: Converting Duration Field value to seconds

MattZerfas — Fri, 04 Sep 2015 20:32:20 GMT

The accepted answer should now be changed to this response since it is now a thing. SOOOO much cleaner and easier.

Re: Converting Duration Field value to seconds

MedralaG — Fri, 28 Jul 2017 14:29:45 GMT

totally agree

Re: Converting Duration Field value to seconds

bugmenot — Thu, 19 Jul 2018 22:36:35 GMT

This answer is not valid, dur2sec does not support milliseconds. Proof: index=* | head 1 | eval CallDuration="00:00:38.60" | convert dur2sec(CallDuration) AS duration -> results in no duration field.