https://community.splunk.com/t5/Splunk-Search/Convert-negative-seconds-to-duration/m-p/227662#M67245 <P>I have a column of seconds, some of which are negative (representing an outage). I want to use <CODE>tostring(duration, "duration")</CODE> on the column, but that doesn't work</P> <PRE><CODE>| stats count | eval count=-5 | eval duration=tostring(count, "duration") </CODE></PRE> Thu, 03 Mar 2016 10:55:05 GMT joxley 2016-03-03T10:55:05Z https://community.splunk.com/t5/Splunk-Search/Convert-negative-seconds-to-duration/m-p/227662#M67245 <P>I have a column of seconds, some of which are negative (representing an outage). I want to use <CODE>tostring(duration, "duration")</CODE> on the column, but that doesn't work</P> <PRE><CODE>| stats count | eval count=-5 | eval duration=tostring(count, "duration") </CODE></PRE> Thu, 03 Mar 2016 10:55:05 GMT https://community.splunk.com/t5/Splunk-Search/Convert-negative-seconds-to-duration/m-p/227662#M67245 joxley 2016-03-03T10:55:05Z https://community.splunk.com/t5/Splunk-Search/Convert-negative-seconds-to-duration/m-p/227663#M67246 <P>Absolute the duration in the conversion and prepend it with a - or empty string.</P> <PRE><CODE>| stats count | eval count=-5 | eval duration=if(count&lt;0, "-", "") + tostring(abs(count), "duration") </CODE></PRE> Thu, 03 Mar 2016 10:56:39 GMT https://community.splunk.com/t5/Splunk-Search/Convert-negative-seconds-to-duration/m-p/227663#M67246 joxley 2016-03-03T10:56:39Z