Convert seconds to MM:SS.ms

[splunk_learner]

Hi
I am trying to convert seconds.milliseconds for ex 4.6566, 0.55,1.2 to Minutes:Second.milliseconds format
I tried tostring(time,duration) but it returns Days:hours:minutes:seconds
Please help

[MuS · Accepted solution]

Hi splunk_learner

try something like this:

... | eval n=strftime(timeStr, "%M:%S.%N")

This example returns the minute, seconds and subseconds from the timeStr field.
See the docs on Commontimeformatvariables for more information on the time format.

update:

just learned that strptime is for time stamp parsing, where strftime is for time stamp formatting.

hope this helps...

cheers, MuS

[twinspop]

MuS was right there, just one change: Use strftime instead of strptime.

| eval test=4.678 | eval str=strftime(test,"%M:%S.%N")

str returned as "00:04.678000000"

[MuS]

a reverted convert mstime() would be the perfect match here

[sowings]

The OP indicated that they have seconds.milli and wanted a nice human-readable string. Sounds like they want strftime (with caveats).

[MuS]

no strftime takes epochtime as input as were strptime takes a time represented by a string....but now after some testing it looks like strptime isn't working either 😞

[sowings]

Did you mean strftime? Also, the latter will interpret timestr as # of seconds since the Unix epoch. While for times < 1 hour (3600 sec) it works just fine, when you start showing the hour, it may deliver confusing results (e.g. in my time zone, I get "16:00:05.12" for an input of "5.12").