- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Besides a series of regex's, is there an automated way to change duration format into plain english?
![Phil219 Phil219](https://community.splunk.com/legacyfs/online/avatars/358217.jpg)
Phil219
Path Finder
05-19-2016
01:12 PM
To make a "plain english" dashboard panel, I currently use the following search to change a duration value (SecondsSinceUpdate) to "ActualTimeSinceUpdate":
|metadata type=hosts
|eval SecondsSinceUpdate = now()-recentTime
|eval ActualTimeSinceUpdate=tostring(SecondsSinceUpdate,"duration")
|rex mode=sed field=ActualTimeSinceUpdate "s/\+/ days, /"
|rex mode=sed field=ActualTimeSinceUpdate "s/\:/ hours, /"
|rex mode=sed field=ActualTimeSinceUpdate "s/\:/ minutes and /"
|rex mode=sed field=ActualTimeSinceUpdate "s/$/ seconds/"
|rex mode=sed field=ActualTimeSinceUpdate "s/\Q00 hours, \E//"
|rex mode=sed field=ActualTimeSinceUpdate "s/\Q00 minutes \E//"
|rex mode=sed field=ActualTimeSinceUpdate "s/\Q 0\E/ /g"
|rex mode=sed field=ActualTimeSinceUpdate "s/^\Q0\E//"
|rex mode=sed field=ActualTimeSinceUpdate "s/^\Qand \E//"
Which results in the attached
How can this be accomplished more simply?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![somesoni2 somesoni2](https://community.splunk.com/legacyfs/online/avatars/100305.jpg)
somesoni2
Revered Legend
05-19-2016
02:07 PM
Try like this
| gentimes start=-10 | append [search index=_internal | head 1 | table _time | bucket span=1s _time | rename _time as endtime]
| eval SecondsSinceUpdate = now()-endtime
| eval ActualTimeSinceUpdate=tostring(SecondsSinceUpdate,"duration")
| eval humanTimeSinceUpdate=replace(replace(replace(ActualTimeSinceUpdate,"(\d+):(\d+):(\d+)$","\1 hours,\2 minutes, \3 seconds"),"(\d+)\+","\1 days,"),"00 \w+,","")
![](/skins/images/396DDBEEAC295EB5FEC41FF128E8AC0A/responsive_peak/images/icon_anonymous_message.png)