Splunk Enterprise

Help needed with eval expression

Sanga
New Member

Hello,

I have a field uptime in seconds as 1231456, Can some one help me with the eval expression to convert this to HH:MM:SS as a new field in a table.

 

Thanks in advance.

Labels (1)
0 Karma

renjith_nair
Legend

you may use

|eval duration=tostring(uptime,"duration")

 

Reference : Conversion functions 

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

A Guide To Cloud Migration Success

As enterprises’ rapid expansion to the cloud continues, IT leaders are continuously looking for ways to focus ...

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...