Splunk Search

Convert HR:MIN:SEC format to 1hr:2min:3sec format

harshparikhxlrd
Path Finder

Hello, I'm trying to convert my time format for the Duration seen below to a format such as 1hr 2min 30 sec display.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If I understand the question correctly, you could replace

| eval dur = round((hh*3600) + (mm*60) + ss,2)
| eval dur = tostring(dur,"duration")

with

| eval dur = hh."hr ".mm."min "."ss."sec"
---
If this reply helps you, Karma would be appreciated.
0 Karma

harshparikhxlrd
Path Finder

Wow, that's exactly what the format. Thank you. Only thing is, if the hours is 0, I wouldn't want the "0" hours to show. Is there any kind of conditional logic we could use for that.

So, instead of showing 0hrs 55 min 30 sec, show 55 min 30 sec, without the 0. And if the hours are more than 1 hour, then display it as such.

0 Karma

harshparikhxlrd
Path Finder

Also slight correction to your post. But yeah, replacing those 2 lines of code with this works.

| eval dur = hh."hr ".mm."min ".ss."sec"
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this.

| eval dur = hh."hr ".mm."min ".ss."sec" 
| rex field=dur mode=sed "s/0hr (.*)/\1/"
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...