Splunk Enterprise Security

How to convert hours into days

yvassilyeva
Path Finder

Hi, 

I have the following duration format that i'd like to convert into days. 

Initial Format             Desired Format
  8741:44                            364 days

   4487:19                          186.9 days

Is there an efficient way to convert this format into days? Thank you in advance.

0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@yvassilyeva 

Can you please try this?

YOUR_SEARCH
| eval "Desired Format"=round(tonumber(mvindex(split('Initial Format',":"),0))/24,2)." Days"

 

My Sample Search :

| makeresults 
| eval "Initial Format"="8741:44|4487:19", "Initial Format"=split('Initial Format',"|") | mvexpand "Initial Format"
| rename comment as "Upto Now is sample data only"
|table "Initial Format"
| eval "Desired Format"=round(tonumber(mvindex(split('Initial Format',":"),0))/24,2)." Days"

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@yvassilyeva 

Can you please try this?

YOUR_SEARCH
| eval "Desired Format"=round(tonumber(mvindex(split('Initial Format',":"),0))/24,2)." Days"

 

My Sample Search :

| makeresults 
| eval "Initial Format"="8741:44|4487:19", "Initial Format"=split('Initial Format',"|") | mvexpand "Initial Format"
| rename comment as "Upto Now is sample data only"
|table "Initial Format"
| eval "Desired Format"=round(tonumber(mvindex(split('Initial Format',":"),0))/24,2)." Days"

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

0 Karma

yvassilyeva
Path Finder

Thank you, that is exactly it!

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...