Convert duration time to number integer

[Miguel3393]

I have this search, where I get the duration and I need to convert it to integer:
Example:

Min:Sec to Whole

00:02      to   1
00:16      to   1
01:53      to  2
09:20      to  10

...etc

Script:

index="cdr" | search "Call.TermParty.TrunkGroup.TrunkGroupId"="2811" OR
"Call.TermParty.TrunkGroup.TrunkGroupId"="2810"
"Call.ConnectTime"=*
"Call.DisconnectTime"=*
|lookup Pais Call.RoutingInfo.DestAddr OUTPUT Countrie
| eval Disctime=strftime('Call.DisconnectTime'/1000,"%m/%d/%Y %H:%M:%S %Q")
| eval Conntime=strftime('Call.ConnectTime'/1000, "%m/%d/%Y %H:%M:%S%Q")
| eval diffTime=('Call.DisconnectTime'-'Call.ConnectTime')
| eval Duracion=strftime(diffTime/1000, "%M:%S") | table Countrie, Duración

Spain 00:02
Spain 00:16
Argentina 00:53
Spain 09:20
Spain 02:54
Spain 28:30
Spain 01:18
Spain 00:28
Spain 16:40
Spain 00:03
Chile 00:25
Uruguay 01:54
Spain 01:54

 Regards.

[bowesmana · Accepted solution]

If you want to get duration as whole rounded up minutes, use ceil, as @isoutamo shows, e.g.

| eval WholeMinutes=ceil(diffTime/1000/60)

[gcusello]

Hi @Miguel3393 ,

at first, don't use the search command after the main search because your search is slower!

Then, you already calculated the difference in seconds in the field diffTime, you have only to add this field to the table command.

then, I'm not sure that the solution to extress the duration in minutes and seconds is correct, you shuld use:

| eval Duracion=tostring(diffTime,"duration")

 In other words, please try this:

index="cdr" ("Call.TermParty.TrunkGroup.TrunkGroupId"="2811" OR
"Call.TermParty.TrunkGroup.TrunkGroupId"="2810") "Call.ConnectTime"=* "Call.DisconnectTime"=*
| lookup Pais Call.RoutingInfo.DestAddr OUTPUT Countrie
| eval Disctime=strftime('Call.DisconnectTime'/1000,"%m/%d/%Y %H:%M:%S %Q")
| eval Conntime=strftime('Call.ConnectTime'/1000, "%m/%d/%Y %H:%M:%S%Q")
| eval diffTime=('Call.DisconnectTime'-'Call.ConnectTime')
| eval Duracion=tostring(diffTime,"duration") 
| table Countrie Duracion diffTime

Ciao.

Giuseppe

[Miguel3393]

Thanks for the response @gcusello 

This is the result I get with what you mention.

Regards.

[gcusello]

Hi @Miguel3393 ,

good for you, see next time!

let us know if we can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[isoutamo]

How about ceil for diffTime?
https://docs.splunk.com/Documentation/Splunk/9.4.0/SearchReference/MathematicalFunctions#ceiling.28....