Splunk Search

Convert seconds to MM:SS.ms

splunk_learner
Explorer

Hi
I am trying to convert seconds.milliseconds for ex 4.6566, 0.55,1.2 to Minutes:Second.milliseconds format
I tried tostring(time,duration) but it returns Days:hours:minutes:seconds
Please help

Tags (2)
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi splunk_learner

try something like this:

... | eval n=strftime(timeStr, "%M:%S.%N")

This example returns the minute, seconds and subseconds from the timeStr field.
See the docs on Commontimeformatvariables for more information on the time format.

update:

just learned that strptime is for time stamp parsing, where strftime is for time stamp formatting.

hope this helps...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi splunk_learner

try something like this:

... | eval n=strftime(timeStr, "%M:%S.%N")

This example returns the minute, seconds and subseconds from the timeStr field.
See the docs on Commontimeformatvariables for more information on the time format.

update:

just learned that strptime is for time stamp parsing, where strftime is for time stamp formatting.

hope this helps...

cheers, MuS

twinspop
Influencer

MuS was right there, just one change: Use strftime instead of strptime.

| eval test=4.678 | eval str=strftime(test,"%M:%S.%N")

str returned as "00:04.678000000"

MuS
SplunkTrust
SplunkTrust

a reverted convert mstime() would be the perfect match here

0 Karma

sowings
Splunk Employee
Splunk Employee

The OP indicated that they have seconds.milli and wanted a nice human-readable string. Sounds like they want strftime (with caveats).

0 Karma

MuS
SplunkTrust
SplunkTrust

no strftime takes epochtime as input as were strptime takes a time represented by a string....but now after some testing it looks like strptime isn't working either 😞

0 Karma

sowings
Splunk Employee
Splunk Employee

Did you mean strftime? Also, the latter will interpret timestr as # of seconds since the Unix epoch. While for times < 1 hour (3600 sec) it works just fine, when you start showing the hour, it may deliver confusing results (e.g. in my time zone, I get "16:00:05.12" for an input of "5.12").

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...