topic Re: Convert SS:%3N format string to milliseconds in Splunk Search

Convert SS:%3N format string to milliseconds

okug — Fri, 18 Dec 2015 19:25:56 GMT

Hi,
An application outputs a processingtime information in "SS:%3N" format (e.g. "3.241" = 3.241 seconds )
Is there a way to convert the string to milliseconds value?

Thanks,
Hiroshi

Re: Convert SS:%3N format string to milliseconds

jkat54 — Sun, 20 Dec 2015 11:23:56 GMT

It's %S.%3Q to get seconds.miliseconds

http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Commontimeformatvariables

You may need to convert from string to a double first using convert or eval with strftime /strptime:

http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Convert
http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/CommonEvalFunctions

Re: Convert SS:%3N format string to milliseconds

masonmorales — Mon, 21 Dec 2015 18:00:46 GMT

| eval processingtimems=processingtime*1000

Re: Convert SS:%3N format string to milliseconds

okug — Mon, 04 Jan 2016 14:40:10 GMT

Oops, there was a typo.
Example log message is 3:241 (not 3.241).

Re: Convert SS:%3N format string to milliseconds

okug — Mon, 04 Jan 2016 14:42:35 GMT

Thanks for your comments.
Original log message is using ":", like 3:241

Could you give me an example usage of strftime / strptime for how to convert "3:241" string to a double?

Thanks,