Archive

Convert HR:MIN:SEC format to 1hr:2min:3sec format

Path Finder

Hello, I'm trying to convert my time format for the Duration seen below to a format such as 1hr 2min 30 sec display.

0 Karma

SplunkTrust
SplunkTrust

If I understand the question correctly, you could replace

| eval dur = round((hh*3600) + (mm*60) + ss,2)
| eval dur = tostring(dur,"duration")

with

| eval dur = hh."hr ".mm."min "."ss."sec"
---
If this reply helps you, an upvote would be appreciated.
0 Karma

Path Finder

Wow, that's exactly what the format. Thank you. Only thing is, if the hours is 0, I wouldn't want the "0" hours to show. Is there any kind of conditional logic we could use for that.

So, instead of showing 0hrs 55 min 30 sec, show 55 min 30 sec, without the 0. And if the hours are more than 1 hour, then display it as such.

0 Karma

Path Finder

Also slight correction to your post. But yeah, replacing those 2 lines of code with this works.

| eval dur = hh."hr ".mm."min ".ss."sec"
0 Karma

SplunkTrust
SplunkTrust

Try this.

| eval dur = hh."hr ".mm."min ".ss."sec" 
| rex field=dur mode=sed "s/0hr (.*)/\1/"
---
If this reply helps you, an upvote would be appreciated.
0 Karma