Convert HR:MIN:SEC format to 1hr:2min:3sec format

[harshparikhxlrd]

Hello, I'm trying to convert my time format for the Duration seen below to a format such as 1hr 2min 30 sec display.

[richgalloway]

If I understand the question correctly, you could replace

| eval dur = round((hh*3600) + (mm*60) + ss,2)
| eval dur = tostring(dur,"duration")

with

| eval dur = hh."hr ".mm."min "."ss."sec"

[harshparikhxlrd]

Wow, that's exactly what the format. Thank you. Only thing is, if the hours is 0, I wouldn't want the "0" hours to show. Is there any kind of conditional logic we could use for that.

So, instead of showing 0hrs 55 min 30 sec, show 55 min 30 sec, without the 0. And if the hours are more than 1 hour, then display it as such.

[harshparikhxlrd]

Also slight correction to your post. But yeah, replacing those 2 lines of code with this works.

| eval dur = hh."hr ".mm."min ".ss."sec"

[richgalloway]

Try this.

| eval dur = hh."hr ".mm."min ".ss."sec" 
| rex field=dur mode=sed "s/0hr (.*)/\1/"