All Apps and Add-ons

Time format "13 Days, 8 Hours, 34 Minutes" to seconds so I can sort by time

nathanluke86
Communicator

Hi all,

I have a time format like 13 Days, 8 Hours, 34 Minutes and need to convert to seconds so I can sort on a dashboard high to low.

I would like to keep the 13 Days, 8 Hours, 34 Minutes format just need to add a field in seconds to sort by

Labels (2)
0 Karma
1 Solution

ITWhisperer
Ultra Champion
| rex field=time "(?<days>\d+) Day(|s), (?<hours>\d+) Hour(|s), (?<minutes>\d+) Minute(|s)" | eval seconds=((((days * 24) + hours) * 60) + minutes) * 60

View solution in original post

nathanluke86
Communicator

@ITWhisperer @thambisetty 

Both of these work I just have 1 small issue as follows

nathanluke86_0-1606211791186.png

 

won't display when:

1 hour NOT hours

1 Minute NOT Minutes.

1 day NOT days

Really grateful for the help so far guys

0 Karma

ITWhisperer
Ultra Champion
| rex field=time "(?<days>\d+) Day(|s), (?<hours>\d+) Hour(|s), (?<minutes>\d+) Minute(|s)" | eval seconds=((((days * 24) + hours) * 60) + minutes) * 60

View solution in original post

nathanluke86
Communicator

@ITWhisperer Thankyou, works perfectly.

0 Karma

thambisetty
Super Champion

@nathanluke86 

| makeresults 
| eval date="13 Days, 8 Hours, 34 Minutes" 
| rex field=date "(?<Days>\d+)\s+Days\,\s+(?<Hours>\d+)\s+Hours\,\s+(?<Minutes>\d+)\s+Minutes" 
| eval seconds=(Days*86400)+(Hours*3600)+(Minutes*60) 
| fields - Days,Hours,Minutes
————————————
If this helps, give a like below.

ITWhisperer
Ultra Champion
| rex field=time "(?<days>\d+) Days, (?<hours>\d+) Hours, (?<minutes>\d+) Minutes" | eval seconds=((((days * 24) + hours) * 60) + minutes) * 60

nathanluke86
Communicator

@ITWhisperer the time is an example I have multiple rows where the time differs.

 

Ideally I would just like to add an extra field that displays in seconds

 

example:

                   date                                                                    date2(new field)

0 Days, 0 Hours, 26 Minutes                                               1560

0 Days, 0 Hours, 27 Minutes                                               1620

0 Days, 0 Hours, 26 Minutes                                               1560

 

tia

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!