Splunk Enterprise Security

Can I convert duration in minutes into days, hours, minutes

jacqu3sy
Path Finder

Hi,

I have a final value in minutes, but I'd like to display this in a more user friendly manner, i.e;

1680 minutes = 1 Day, 4 Hours.

Any ideas how this could be done? Thanks.

0 Karma
1 Solution

vnravikumar
Champion

Hi

Try this

| makeresults 
| eval minutes=1680 
| eval result = tostring(minutes*60, "duration") 
| eval duration2=replace(result,"(\d*)\+*(\d+):(\d+):(\d+)","\1 days \2 hours \3 minutes \4 secs")

View solution in original post

vnravikumar
Champion

Hi

Try this

| makeresults 
| eval minutes=1680 
| eval result = tostring(minutes*60, "duration") 
| eval duration2=replace(result,"(\d*)\+*(\d+):(\d+):(\d+)","\1 days \2 hours \3 minutes \4 secs")

jacqu3sy
Path Finder

Hi, is there a way to drop the days and tidy it up so that instead of;

0 days 1 hours 43 minutes 47 secs.1428571428578

it produces;

1 hour, 43 minutes, 47 seconds.

Thanks!!

0 Karma

FrankVl
Ultra Champion

Do you just want to strip off "0 days", or do you want to multiply the number of days by 24 and add it to the hours?

Stripping of the "0 days" should be easy enough, just change the last line of that query to not print the days (remove the \1 days😞

 | eval duration2=replace(result,"(\d*)\+*(\d+):(\d+):(\d+)","\2 hours \3 minutes \4 secs")
0 Karma

jacqu3sy
Path Finder

Probably need to multiply the number of days I guess. I need the total number of hours to jump to say, 28 hours, instead of 1 day, 4 hours.... if that makes sense

0 Karma

vnravikumar
Champion

Hi

try this

| makeresults 
| eval minutes=1698 
| eval result = tostring(minutes*60, "duration") 
| rex field=result "((?P<day>\d+)\+){0,1}(?P<hour>\d{2}):(?P<min>\d{2}):(?P<sec>\d{2})" 
| eval hour=if(day>0,((day*24))+hour,hour) 
| eval result = hour." hours ".min." minutes ".sec." seconds" 
| table result

jaxjohnny2000
Builder

I made one adjustment in case you need the days to show up
If days are less than 1, there will be no value, so fillnull to 0


| makeresults
| eval minutes=1698
| eval result = tostring(minutes*60, "duration")
| rex field=result "((?P<day>\d+)\+){0,1}(?P<hour>\d{2}):(?P<min>\d{2}):(?P<sec>\d{2})"
| fillnull value=0 day
| eval result = day." days ".hour." hours ".min." minutes ".sec." seconds"
| table result


Adjusting the minutes value:

| makeresults
| eval minutes=111698
| eval result = tostring(minutes*60, "duration")
| rex field=result "((?P<day>\d+)\+){0,1}(?P<hour>\d{2}):(?P<min>\d{2}):(?P<sec>\d{2})"
| fillnull value=0 day
| eval result = day." days ".hour." hours ".min." minutes ".sec." seconds"
| table result

0 Karma

FrankVl
Ultra Champion

That's what I was going to suggest as well 🙂

0 Karma

jacqu3sy
Path Finder

Your both beautiful people 🙂

Thanks for the help.

0 Karma

jacqu3sy
Path Finder

beautiful. Thanks 🙂

0 Karma

jacqu3sy
Path Finder

Perfect. Thanks.

0 Karma

jacqu3sy
Path Finder

Sorry, me again. How would I tweak that if I wanted to drop the days from the output? so no mention of days, and just a total by hours, minutes, seconds? Thanks.

0 Karma
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...