topic Re: How to edit my search to remove .000 from the end of a time field (HH:MM.000)? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-remove-000-from-the-end-of-a-time-field/m-p/226626#M66836 <P>Replace you search with what I had</P> Thu, 11 Aug 2016 15:24:50 GMT sundareshr 2016-08-11T15:24:50Z How to edit my search to remove .000 from the end of a time field (HH:MM.000)? https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-remove-000-from-the-end-of-a-time-field/m-p/226621#M66831 <P>I have a search that creates a time in <CODE>HH:MM</CODE> and looks like <CODE>04:34.000</CODE>. How can I drop the <CODE>.000</CODE> at the end of this? Here is the part of my search that gets the time.</P> <PRE><CODE>| addinfo | eval duration=info_max_time-info_min_time | eval dur_formatted=tostring(duration, "duration") | eval HH:MM:SS=tostring('duration', "duration") | convert rmunit("duration") as numSecs | eval "duration" = round('duration',0) | eval stringSecs2=tostring(numSecs,"duration") | eval "Total Time in HH:MM" = replace(stringSecs2,"(\d+)\:(\d+)\:(\d+)","\1:\2") </CODE></PRE> Thu, 11 Aug 2016 15:09:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-remove-000-from-the-end-of-a-time-field/m-p/226621#M66831 chadman 2016-08-11T15:09:41Z Re: How to edit my search to remove .000 from the end of a time field (HH:MM.000)? https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-remove-000-from-the-end-of-a-time-field/m-p/226622#M66832 <P>Try this</P> <PRE><CODE>| addinfo | eval duration=info_max_time-info_min_time | eval dur_formatted=tostring(round(duration, 0), "duration") | table duration dur_formatted </CODE></PRE> Thu, 11 Aug 2016 15:13:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-remove-000-from-the-end-of-a-time-field/m-p/226622#M66832 sundareshr 2016-08-11T15:13:23Z Re: How to edit my search to remove .000 from the end of a time field (HH:MM.000)? https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-remove-000-from-the-end-of-a-time-field/m-p/226623#M66833 <P>You could use <CODE>rtrim</CODE> to cut the last 3 digits </P> <P><CODE>... | eval stringSecs2 = rtrim(stringSecs2,substr(stringSecs2,-3))</CODE></P> Thu, 11 Aug 2016 15:15:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-remove-000-from-the-end-of-a-time-field/m-p/226623#M66833 skoelpin 2016-08-11T15:15:28Z Re: How to edit my search to remove .000 from the end of a time field (HH:MM.000)? https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-remove-000-from-the-end-of-a-time-field/m-p/226624#M66834 <P>That worked! thanks.</P> Thu, 11 Aug 2016 15:22:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-remove-000-from-the-end-of-a-time-field/m-p/226624#M66834 chadman 2016-08-11T15:22:03Z Re: How to edit my search to remove .000 from the end of a time field (HH:MM.000)? https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-remove-000-from-the-end-of-a-time-field/m-p/226625#M66835 <P>I could not get that to work. Were you say to replace what I had with that?</P> Thu, 11 Aug 2016 15:22:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-remove-000-from-the-end-of-a-time-field/m-p/226625#M66835 chadman 2016-08-11T15:22:49Z Re: How to edit my search to remove .000 from the end of a time field (HH:MM.000)? https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-remove-000-from-the-end-of-a-time-field/m-p/226626#M66836 <P>Replace you search with what I had</P> Thu, 11 Aug 2016 15:24:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-remove-000-from-the-end-of-a-time-field/m-p/226626#M66836 sundareshr 2016-08-11T15:24:50Z Re: How to edit my search to remove .000 from the end of a time field (HH:MM.000)? https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-remove-000-from-the-end-of-a-time-field/m-p/226627#M66837 <P>Would this work?</P> <PRE><CODE>| eval "Total Time in HH:MM"=strptime("Total Time in HH:MM", "%H:%M") </CODE></PRE> <P>"strptime(X,Y) This function takes a time represented by a string, X, and parses it into a timestamp using the format specified by Y. For a list and descriptions of format options, refer to the topic "Common time format variables". If timeStr is in the form, "11:59", this returns it as a timestamp:"</P> Thu, 11 Aug 2016 15:26:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-remove-000-from-the-end-of-a-time-field/m-p/226627#M66837 JDukeSplunk 2016-08-11T15:26:16Z Re: How to edit my search to remove .000 from the end of a time field (HH:MM.000)? https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-remove-000-from-the-end-of-a-time-field/m-p/226628#M66838 <P>when I did that I get "no results found"</P> Thu, 11 Aug 2016 15:27:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-remove-000-from-the-end-of-a-time-field/m-p/226628#M66838 chadman 2016-08-11T15:27:16Z