Splunk Search

Convert HR:MIN:SEC format to 1hr:2min:3sec format

harshparikhxlrd
Path Finder

Hello, I'm trying to convert my time format for the Duration seen below to a format such as 1hr 2min 30 sec display.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If I understand the question correctly, you could replace

| eval dur = round((hh*3600) + (mm*60) + ss,2)
| eval dur = tostring(dur,"duration")

with

| eval dur = hh."hr ".mm."min "."ss."sec"
---
If this reply helps you, Karma would be appreciated.
0 Karma

harshparikhxlrd
Path Finder

Wow, that's exactly what the format. Thank you. Only thing is, if the hours is 0, I wouldn't want the "0" hours to show. Is there any kind of conditional logic we could use for that.

So, instead of showing 0hrs 55 min 30 sec, show 55 min 30 sec, without the 0. And if the hours are more than 1 hour, then display it as such.

0 Karma

harshparikhxlrd
Path Finder

Also slight correction to your post. But yeah, replacing those 2 lines of code with this works.

| eval dur = hh."hr ".mm."min ".ss."sec"
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this.

| eval dur = hh."hr ".mm."min ".ss."sec" 
| rex field=dur mode=sed "s/0hr (.*)/\1/"
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...