Security

How to convert Millsec to Seconds

jaibalaraman
Path Finder

Hi Team 

How to convert millsec value to seconds 

index=testing | timechart max("event.Properties.duration")

Can anyone helps to with spl query search converting value  millsec value to seconds 

 

jaibalaraman_0-1713780304253.png

 

 

Labels (1)
Tags (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Use this

index=testing 
| timechart max("event.Properties.duration") as maxDuration
| eval maxDuration=round(maxDuration/1000, 3)

 

0 Karma

deepakc
Builder

Here's an example, you can then change to your SPL fields

| makeresults
| eval millis_sec = 5000
| eval seconds = millis_sec/1000
| table millis_sec, seconds
0 Karma

jaibalaraman
Path Finder

Hi Deepak 

I am bit confused using the time command 

Filed name - event.Properties.duration 

How do i execute this in the command. 

I tried the below but sure i am missing something 

index=testing  | "event.Properties.duration"="*"
| makeresults
| eval millis_sec = 5000
| eval seconds = millis_sec/1000
| table millis_sec, seconds
0 Karma

PickleRick
SplunkTrust
SplunkTrust

@deepakc's was a so-called "run-anywhere" example. A sequence of commands that can be run on its own without any additional data that you need to search for, meant for showing some mechanism. It starts with a makeresults command which creates an "empty" result.

This example was not meant to be run as part of your search but you should do something similar with your data and your field names.

0 Karma

kiran_panchavat
Contributor

@jaibalaramanIf the time is in milliseconds, microseconds, or nanoseconds you must convert the time into seconds. You can use the pow function to convert the number.

  • To convert from milliseconds to seconds, divide the number by 1000 or 10^3.
  • To convert from microseconds to seconds, divide the number by 10^6.
  • To convert from nanoseconds to seconds, divide the number by 10^9.

Date and Time functions - Splunk Documentation

*** If the above solution helps, an upvote is appreciated. *** 
 

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...