Splunk Search

## Convert seconds in days, hours and minutes?

Path Finder

Hi, i have a duration in seconds and want to convert it to days, hours and minutes. The additional seconds should be just cut off in the output. Ideally there should be no leading zeros (not "04 hours" but "4 hours") and if days, hours or minutes is 0 they should not be displayed in the output.

Examples:

 Duration in seconds Output 14400 "4 hours" 14432 "4 hours" 604800 "7 days" 1800 "30 minutes" 108002 "1 day 6 hours"
Labels (5)

• ### rex

Tags (5)
1 Solution
SplunkTrust

Hi @simon_b,

the easiest way is to use the tostring function:

``| eval duration=tostring(duration,"duration")``

if yu don't like the output format, you can convert using an eval calculation:

``````| eval
days=if(duration>86400,round(duration/86400,0),""),
hours=if(duration>3600,round(duration-days*86400,0),""),
minutes=if(duration>60,round(duration-days*86400-hours*3600,0),""),
seconds=duration-days*86400-hours*3600-minutes*60
| eval Output=days.if(days>0," days ","").hours.if(hours>0," hours ","").minutes.if(minutes>0," minutes ","").seconds." seconds"``````

Ciao.

Giuseppe

SplunkTrust

Hi @simon_b,

the easiest way is to use the tostring function:

``| eval duration=tostring(duration,"duration")``

if yu don't like the output format, you can convert using an eval calculation:

``````| eval
days=if(duration>86400,round(duration/86400,0),""),
hours=if(duration>3600,round(duration-days*86400,0),""),
minutes=if(duration>60,round(duration-days*86400-hours*3600,0),""),
seconds=duration-days*86400-hours*3600-minutes*60
| eval Output=days.if(days>0," days ","").hours.if(hours>0," hours ","").minutes.if(minutes>0," minutes ","").seconds." seconds"``````

Ciao.

Giuseppe

Path Finder

Hi @gcusello ,

I used your logic, but with a small change in the function used. (floor instead or round).

Would this make more sense to you?

``````| eval duration=round((now() - last_seen),0)
| eval
days=if(duration>86400,floor(duration/86400),"0"),
hours=if(duration>3600,floor((duration-days*86400)/3600),"0"),
minutes=if(duration>60,floor((duration-days*86400-hours*3600)/60),"0"),
seconds=duration-days*86400-hours*3600-minutes*60
| eval Output=days.if(days>0," days ","").hours.if(hours>0," hours ","").minutes.if(minutes>0," minutes ","").seconds." seconds"``````

SplunkTrust

This example

``````| makeresults
| eval _raw="Duration in seconds	Output
14400	4 hours
14432	4 hours
604800	7 days
1800	30 minutes
108002	1 day 6 hours"
| table Dur* Ou*
``` Calculation ```
| eval days=floor(Duration_in_seconds/86400), days=if(days>0, days." days", "")
| eval remain=Duration_in_seconds % 86400
| eval hours=floor(remain/3600), hours=if(hours>0, hours." hours", "")
| eval remain=remain % 3600
| eval minutes=floor(remain/60), minutes=if(minutes>0, minutes." minutes", "")
| eval NewOutput=trim(printf("%s %s %s", days, hours, minutes))
| table Duration_in_seconds Output NewOutput``````

The first part sets up the example data - use the SPL following the Calculation comment

You could also replace all the eval statements following the Calculation with the following that will do the same

``````| eval remain=Duration_in_seconds, NewOutput="", n=0, types=split("days,hours,minutes",",")
| foreach 86400 3600 60  [ eval t=floor(remain/<<FIELD>>), NewOutput=NewOutput.(if(t>0, " ".t." ".mvindex(types, n), "")), remain=remain % <<FIELD>>, n=n+1 ]
| table Duration_in_seconds Output NewOutput``````

Note that this example causes the field name to be Duration_in_seconds with _ character instead of space

Get Updates on the Splunk Community!

#### 3 Ways to Make OpenTelemetry Even Better

My role as an Observability Specialist at Splunk provides me with the opportunity to work with customers of ...

#### What's New in Splunk Cloud Platform 9.2.2406?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2406 with many ...

#### Enterprise Security Content Update (ESCU) | New Releases

In August, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...