Can't convert timeformat to unix

[dtaylor]

Hopefully I've only got a small problem this time, but I've had no luck fixing it despite hours of trying. All I'm trying to do is convert a string time field to unix using strptime. This is my time field:

Ended: 0d1h55m0s

I've been trying to convert it to unix using the following command:

| eval time_sec = strptime('Time', "Ended: %dd%Hh%Mm%Ss")

For clarity, this is the full search:

| inputlookup metrics.csv
| eval occurred=strftime(strptime(occurred,"%a, %d %b %Y %T %Z"), "%F %T %Z")
| eval closed=strftime(strptime(closed,"%a, %d %b %Y %T %Z"), "%F %T %Z")
| eval time_sec = strptime('Time', "Ended: %dd%Hh%Mm")
| where strptime(occurred, "%F %T") >= strptime("2025-05-01 00:00:00", "%F %T") AND (isnull(closeReason) OR closeReason="Resolved")
| fillnull value=Resolved closeReason

The example time I've posted above 0d1h55m0s should ideally convert to 6900(seconds).

[yuanliu]

In addition to @PrewinThomas's breakdown method, I can suggest relative_time to take advantage of Splunk's format strings.

| eval offset = replace('Time', "Ended: (\d+d)(\d+h)(\d+m)(\d+s)", "+\1+\2+\3")
| eval time_sec = relative_time(0, offset)

relative_time's offset requires a + or a - before every time unit.  So, we transform 0d1h55m0s to +0d+1h+55m.

[PrewinThomas · Accepted solution]

@dtaylor 

strptime expects a date/time string, not a duration.
Your field (Ended: 0d1h55m0s) is a duration (days, hours, minutes, seconds), not an absolute date/time.

try below,

| rex field=Time "Ended: (?<days>\d+)d(?<hours>\d+)h(?<minutes>\d+)m(?<seconds>\d+)s"
| eval duration = (days*86400) + (hours*3600) + (minutes*60) + seconds

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a kudos. Thanks!