Splunk Enterprise Security

How to convert hours into days

yvassilyeva
Path Finder

Hi, 

I have the following duration format that i'd like to convert into days. 

Initial Format             Desired Format
  8741:44                            364 days

   4487:19                          186.9 days

Is there an efficient way to convert this format into days? Thank you in advance.

Labels (1)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@yvassilyeva 

Can you please try this?

YOUR_SEARCH
| eval "Desired Format"=round(tonumber(mvindex(split('Initial Format',":"),0))/24,2)." Days"

 

My Sample Search :

| makeresults 
| eval "Initial Format"="8741:44|4487:19", "Initial Format"=split('Initial Format',"|") | mvexpand "Initial Format"
| rename comment as "Upto Now is sample data only"
|table "Initial Format"
| eval "Desired Format"=round(tonumber(mvindex(split('Initial Format',":"),0))/24,2)." Days"

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@yvassilyeva 

Can you please try this?

YOUR_SEARCH
| eval "Desired Format"=round(tonumber(mvindex(split('Initial Format',":"),0))/24,2)." Days"

 

My Sample Search :

| makeresults 
| eval "Initial Format"="8741:44|4487:19", "Initial Format"=split('Initial Format',"|") | mvexpand "Initial Format"
| rename comment as "Upto Now is sample data only"
|table "Initial Format"
| eval "Desired Format"=round(tonumber(mvindex(split('Initial Format',":"),0))/24,2)." Days"

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

0 Karma

yvassilyeva
Path Finder

Thank you, that is exactly it!

0 Karma
Get Updates on the Splunk Community!

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...

Cloud Platform & Enterprise: Classic Dashboard Export Feature Deprecation

As of Splunk Cloud Platform 9.3.2408 and Splunk Enterprise 9.4, classic dashboard export features are now ...