All Apps and Add-ons

Time format "13 Days, 8 Hours, 34 Minutes" to seconds so I can sort by time

nathanluke86
Communicator

Hi all,

I have a time format like 13 Days, 8 Hours, 34 Minutes and need to convert to seconds so I can sort on a dashboard high to low.

I would like to keep the 13 Days, 8 Hours, 34 Minutes format just need to add a field in seconds to sort by

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=time "(?<days>\d+) Day(|s), (?<hours>\d+) Hour(|s), (?<minutes>\d+) Minute(|s)" | eval seconds=((((days * 24) + hours) * 60) + minutes) * 60

View solution in original post

nathanluke86
Communicator

@ITWhisperer @thambisetty 

Both of these work I just have 1 small issue as follows

nathanluke86_0-1606211791186.png

 

won't display when:

1 hour NOT hours

1 Minute NOT Minutes.

1 day NOT days

Really grateful for the help so far guys

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=time "(?<days>\d+) Day(|s), (?<hours>\d+) Hour(|s), (?<minutes>\d+) Minute(|s)" | eval seconds=((((days * 24) + hours) * 60) + minutes) * 60

nathanluke86
Communicator

@ITWhisperer Thankyou, works perfectly.

0 Karma

thambisetty
SplunkTrust
SplunkTrust

@nathanluke86 

| makeresults 
| eval date="13 Days, 8 Hours, 34 Minutes" 
| rex field=date "(?<Days>\d+)\s+Days\,\s+(?<Hours>\d+)\s+Hours\,\s+(?<Minutes>\d+)\s+Minutes" 
| eval seconds=(Days*86400)+(Hours*3600)+(Minutes*60) 
| fields - Days,Hours,Minutes
————————————
If this helps, give a like below.

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=time "(?<days>\d+) Days, (?<hours>\d+) Hours, (?<minutes>\d+) Minutes" | eval seconds=((((days * 24) + hours) * 60) + minutes) * 60

nathanluke86
Communicator

@ITWhisperer the time is an example I have multiple rows where the time differs.

 

Ideally I would just like to add an extra field that displays in seconds

 

example:

                   date                                                                    date2(new field)

0 Days, 0 Hours, 26 Minutes                                               1560

0 Days, 0 Hours, 27 Minutes                                               1620

0 Days, 0 Hours, 26 Minutes                                               1560

 

tia

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...