Convert duration in hours to duration in minutes

[zoebanning]

Hello Splunk Community, 

Can anyone help me build a query based on the below;

I have built a query which calculates the total duration of multiple events over a period of time. 

What I am trying to do now is create a timechart to show the _time on x-axis and duration on y-axis. 

I think I need to convert the duration from hours to minutes but not sure how to do this.

Below is an example of the output from my original query I am trying to visualise in a timechart;

_time	duration (in hours)
2021-10-12	03:56:30
2021-10-13	04:27:25
2021-10-14	04:21:03
2021-10-18	07:11:04

THANK YOU (in advance)

[bowesmana · Accepted solution]

Perhaps you should be changing the query that generates that field "duration (in hours)" to one that generates it in the granularity you need.

Is your existing query performing some calculation between two numbers to calculate duration. If so, then just use that rather than format it as string.

[venkatasri]

Hi @zoebanning 

Try this i wish there would be direct function to,

| makeresults 
| eval time="03:56:30" 
| eval epoch=strptime(time, "%H:%M:%S") 
| eval hours=strftime(epoch, "%H"), sec=strftime(epoch, "%S"), m=strftime(epoch, "%M") 
| eval minutes= hours*60 + m + (sec / 60)

--

An upvote would be appreciated if this reply helps!