topic Re: How to transform a field into a time format? in Splunk Search

How to transform a field into a time format?

skoelpin — Fri, 18 Sep 2015 19:46:50 GMT

I extracted deployment time from events and it's currently in this format 0:04.645 and 1:30.123 and is in terms of Minutes, Seconds, Milliseconds. I need to sum this time up every day and graph it.

How can I put this in a time format in seconds?

Example:

0:04.645
1:30.123

sum = 94.768 seconds

Re: How to transform a field into a time format?

bmacias84 — Fri, 18 Sep 2015 20:05:21 GMT

Use the strptime command.

... |eval atime=strptime(fieldname, "%M:%S.%3N")

Re: How to transform a field into a time format?

woodcock — Fri, 18 Sep 2015 20:08:47 GMT

You need the tostring like this:

...  | rex field=field1 "(?<H>.*?))?:?((?<M>.*?))?:?(?<S>.*?)" | fillnull value=0 | eval onlySeconds1 =  S + 60*(M + 60*H) | rex field=field2 "(?<H>.*?))?:?((?<M>.*?))?:?(?<S>.*?)" | fillnull value=0 | eval onlySeconds2 =  S + 60*(M + 60*H) | eval =sumSeconds = onlySeconds1 + onlySeconds2 | eval sumTime = tostring(sumSeconds, "duration")

Re: How to transform a field into a time format?

woodcock — Fri, 12 Aug 2016 16:05:46 GMT

Does this really work? First of all, it is not syntactically correct (missing eval). Secondly it generates a time_t, not a duration.