Convert Decimal to Time Format

[nlisle]

Hello, 

I currently have the below search will calculates on average how much time is being spent on the alerts that Splunk generates. On average, it has been calculated that 15 minutes would be spent on each alert for investigation etc. Therefore the below search was written. 

index="_internal" sourcetype="scheduler" thread_id="AlertNotifier*" alert_actions=email savedsearch_name=*
| stats count
| eval count=count/4

Result example: 14 Results x 15 Minutes = 210 Minutes/3 Hours 30 Minutes. My results are showing as '3.5 Hours. '

How could I change this so my final results will be in the format of '3 Hours 30 Minutes'.

Thanks.

N. 

[gcusello]

Hi @nlisle,

you can use the tostring function (with the "duration" option) in the eval command, something like this:

| eval count=tostring(count,"duration") 

 Ciao.

Giuseppe

[ITWhisperer]

index="_internal" sourcetype="scheduler" thread_id="AlertNotifier*" alert_actions=email savedsearch_name=*
| stats count
| eval count=count * 15 * 60
| eval count=tostring(count,"duration")