I am trying to get some details from my event text which has the record count and also the processing time. I want to find the processing rate.I.e records/processing time. I could find that the processing time
Is like 1.2s where s is seconds. Sometimes its like 567ms where ms is milliseconds or 1h2m.0030s where h m and s are hours minutes and second respectively.
Is there any function which can help me to convert it all into either ms
or seconds. Or could could you please suggest how I could change it into a unified format like seconds ?
As I am stuck with critical deliverable need your inputs as soon as possible 😞
Like this:
... | eval durationSeconds =coalesce(strptime(fieldname, "%Hh%Mm%S.%Ns"), strptime(fieldname, "%Nms"))
You may need to add more pieces to the coalesce
to accommodate other alternate formats.
See if this is similar to your problem.
https://answers.splunk.com/answers/128981/converting-duration-field-value-to-seconds.html