Help needed with eval expression - Splunk Community

Splunk Enterprise

Hello,

I have a field uptime in seconds as 1231456, Can some one help me with the eval expression to convert this to HH:MM:SS as a new field in a table.

Thanks in advance.

you may use

|eval duration=tostring(uptime,"duration")

Reference : Conversion functions

---
What goes around comes around. If it helps, hit it with Karma 🙂

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...