All Apps and Add-ons

Time format "13 Days, 8 Hours, 34 Minutes" to seconds so I can sort by time

nathanluke86
Communicator

Hi all,

I have a time format like 13 Days, 8 Hours, 34 Minutes and need to convert to seconds so I can sort on a dashboard high to low.

I would like to keep the 13 Days, 8 Hours, 34 Minutes format just need to add a field in seconds to sort by

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=time "(?<days>\d+) Day(|s), (?<hours>\d+) Hour(|s), (?<minutes>\d+) Minute(|s)" | eval seconds=((((days * 24) + hours) * 60) + minutes) * 60

View solution in original post

nathanluke86
Communicator

@ITWhisperer @thambisetty 

Both of these work I just have 1 small issue as follows

nathanluke86_0-1606211791186.png

 

won't display when:

1 hour NOT hours

1 Minute NOT Minutes.

1 day NOT days

Really grateful for the help so far guys

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=time "(?<days>\d+) Day(|s), (?<hours>\d+) Hour(|s), (?<minutes>\d+) Minute(|s)" | eval seconds=((((days * 24) + hours) * 60) + minutes) * 60

nathanluke86
Communicator

@ITWhisperer Thankyou, works perfectly.

0 Karma

thambisetty
SplunkTrust
SplunkTrust

@nathanluke86 

| makeresults 
| eval date="13 Days, 8 Hours, 34 Minutes" 
| rex field=date "(?<Days>\d+)\s+Days\,\s+(?<Hours>\d+)\s+Hours\,\s+(?<Minutes>\d+)\s+Minutes" 
| eval seconds=(Days*86400)+(Hours*3600)+(Minutes*60) 
| fields - Days,Hours,Minutes
————————————
If this helps, give a like below.

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=time "(?<days>\d+) Days, (?<hours>\d+) Hours, (?<minutes>\d+) Minutes" | eval seconds=((((days * 24) + hours) * 60) + minutes) * 60

nathanluke86
Communicator

@ITWhisperer the time is an example I have multiple rows where the time differs.

 

Ideally I would just like to add an extra field that displays in seconds

 

example:

                   date                                                                    date2(new field)

0 Days, 0 Hours, 26 Minutes                                               1560

0 Days, 0 Hours, 27 Minutes                                               1620

0 Days, 0 Hours, 26 Minutes                                               1560

 

tia

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...