Splunk Enterprise Security

How to convert hours into days

yvassilyeva
Path Finder

Hi, 

I have the following duration format that i'd like to convert into days. 

Initial Format             Desired Format
  8741:44                            364 days

   4487:19                          186.9 days

Is there an efficient way to convert this format into days? Thank you in advance.

0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@yvassilyeva 

Can you please try this?

YOUR_SEARCH
| eval "Desired Format"=round(tonumber(mvindex(split('Initial Format',":"),0))/24,2)." Days"

 

My Sample Search :

| makeresults 
| eval "Initial Format"="8741:44|4487:19", "Initial Format"=split('Initial Format',"|") | mvexpand "Initial Format"
| rename comment as "Upto Now is sample data only"
|table "Initial Format"
| eval "Desired Format"=round(tonumber(mvindex(split('Initial Format',":"),0))/24,2)." Days"

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@yvassilyeva 

Can you please try this?

YOUR_SEARCH
| eval "Desired Format"=round(tonumber(mvindex(split('Initial Format',":"),0))/24,2)." Days"

 

My Sample Search :

| makeresults 
| eval "Initial Format"="8741:44|4487:19", "Initial Format"=split('Initial Format',"|") | mvexpand "Initial Format"
| rename comment as "Upto Now is sample data only"
|table "Initial Format"
| eval "Desired Format"=round(tonumber(mvindex(split('Initial Format',":"),0))/24,2)." Days"

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

0 Karma

yvassilyeva
Path Finder

Thank you, that is exactly it!

0 Karma
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...