Besides a series of regex's, is there an automated way to change duration format into plain english?

[Phil219]

To make a "plain english" dashboard panel, I currently use the following search to change a duration value (SecondsSinceUpdate) to "ActualTimeSinceUpdate":

|metadata type=hosts 
|eval SecondsSinceUpdate = now()-recentTime
|eval ActualTimeSinceUpdate=tostring(SecondsSinceUpdate,"duration")
|rex mode=sed field=ActualTimeSinceUpdate "s/\+/ days, /"
|rex mode=sed field=ActualTimeSinceUpdate "s/\:/ hours, /"
|rex mode=sed field=ActualTimeSinceUpdate "s/\:/ minutes and /"
|rex mode=sed field=ActualTimeSinceUpdate "s/$/ seconds/"
|rex mode=sed field=ActualTimeSinceUpdate "s/\Q00 hours, \E//"
|rex mode=sed field=ActualTimeSinceUpdate "s/\Q00 minutes \E//"
|rex mode=sed field=ActualTimeSinceUpdate "s/\Q 0\E/ /g"
|rex mode=sed field=ActualTimeSinceUpdate "s/^\Q0\E//"
|rex mode=sed field=ActualTimeSinceUpdate "s/^\Qand \E//"

Which results in the attached

How can this be accomplished more simply?

[somesoni2]

Try like this

| gentimes start=-10 | append [search index=_internal | head 1 | table _time | bucket span=1s _time | rename _time as endtime]
 | eval SecondsSinceUpdate = now()-endtime 
 | eval ActualTimeSinceUpdate=tostring(SecondsSinceUpdate,"duration") 
| eval humanTimeSinceUpdate=replace(replace(replace(ActualTimeSinceUpdate,"(\d+):(\d+):(\d+)$","\1 hours,\2 minutes, \3 seconds"),"(\d+)\+","\1 days,"),"00 \w+,","")