exatracing seconds from the string "2h:30m:20s:

[Pavankt]

i have a splunk array 

per_stage_data: [ [-]
     { [-]
       Stage: S1
        TimeTaken: 0h:30m:23s
     }
     { [-]
       Stage: S2
        TimeTaken: 0h:52m:36s
     }
    ]

i am implementing a splunk dashboard , in that i want to convert the per_stage_data{}.TimeTaken into seconds. i had tried multiple ways but it didn't worked.

tried using the below solution  but it's not giving any output.

rex field="_raw" "CallDuration: (?<hours>\d+)h:(?<minutes>\d+)m:(?<seconds>\d+)s" | eval CallDurationInSeconds = ((hours*60*60)+(minutes*60)+(seconds))

appreciate any inputs.

Thanks in advance. 

[ITWhisperer]

Firstly, why are you using "CallDuration" as you text anchor in the regex when your sample show "TimeTaken"?

Secondly, your JSON array has multiple entries, so, if you know how many entries (Stages) will be present, you can include that in your regex and extract each one separately, or you can use max_match=0 to extract them all into a multi-value field.

Thirdly, for it to be valid JSON, there would be double quotes in the string which would need to be escaped in the regex.

| rex field="_raw" max_match=0 "\"TimeTaken\": \"(?<hours>\d+)h:(?<minutes>\d+)m:(?<seconds>\d+)s\""

Fourthly, if it is JSON, why aren't you using spath to extract the fields (assuming you haven't extracted them as part of the sourcetype definition)?

[Pavankt]

Thanks for the reply Actually my json file contains total 2 stages as below.

per_stage_info_vendor_data: [ [-]
     { [-]
       Stage: stage1
       WallClockTime: 0h:30m:23s
     }
     { [-]
       Stage: stage2
        WallClockTime: 0h:52m:36s
     }
      ]

with following regular expression we are able to get the hours mins and seconds.

rex field=per_stage_info_vendor_data{}.WallClockTime max_match=0 "((?<hours>\d+)h:(?<minutes>\d+)m:(?<seconds>\d+)s)"

But when i tried |eval  stagetime=hours*3600+minutes*60+seconds  it's not working, when i checked further any of the arithmetic  operation on these three fields(hours,minutes and seconds).

do i need to convert these fields to any other format.