Getting Data In

How to convert HH:MM:SS.6Q time format in to Minutes

gravi
Explorer

Hi,

I am trying to convert Timestamp into Minutes and the result is not being displayed. I have the timestamp format as HH:MM:SS.SSSSSS and I want to convert to Minutes.

I have tried using |convert dur2sec(since) as TimeinSec | eval timeinMin=TimeinSec/60 but did not work.

could you please help?

0 Karma

woodcock
Esteemed Legend

Like this:

| makeresults 
| eval time="12:34:56.654321" 

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| rex field=time "(?:(?:(?<duration_hours>\d+):)?(?<duration_minutes>\d+):)?(?<duration_seconds>.+)$" 
| fillnull value=0 duration_hours duration_minutes 
| eval duration = duration_seconds + (60 * (duration_minutes + (60 * duration_hours))) 
| fieldformat duration = tostring(duration, "duration")
| fieldformat duration_in_minutes = duration / 60
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use strptime to convert Timestamp into seconds then convert to minutes.

... | eval Minutes=strptime(Timestamp, "%H:%M:%S.%6N")/60
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...