Hi Everyone
I have multiple rex queries in my dashboard which are taking much time.
Is there any way, to take out the rex from my dashboard.
Query what I am using is
|rex field=a "(?<a_hour>[^:]+)?:(?<a_min>\d+)?:(?<a_sec>\d+)"
| eval a_seconds =(a_hour*3600)+(a_min * 60) + a_sec
Like this I have multiple queries for multiple fields.
Please help me out.
Thanks
Nikks
Give this a try (adding HH portion if not present, then using convert)
....| eval a=if(len(a)!=8,"00".a,a)
| convert dur2sec(a) as a_seconds
Give this a try (adding HH portion if not present, then using convert)
....| eval a=if(len(a)!=8,"00".a,a)
| convert dur2sec(a) as a_seconds
Thanks somesoni.
It worked.
Can we create a calculated field for the
| eval a=if(len(a)!=8,"00".a,a)
| convert dur2sec(a) as a_seconds
Thanks
Nikks
Can we have some sample data please, for field a
?
i agree, can we have a few samples of this? if you timestamp is in :MM:HH, the regex above doesn't seem likely to work properly.
Hi
it use to get data like
:00:00
12:34:78
:34:56
your field a is HH:MM:SS?
you could just do a |convert dur2sec(a) as a_seconds
https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/SearchReference/Convert
Hi
it is in :MM:HH format.
I tried |convert dur2sec(a) as a_seconds
but it didn't work with above format.
Is there any other way?
Thanks
Nikks
can you try to add timeformat=":%M:%H"
Can you tell me the way how to add this?