Splunk Search

## Converting Duration Field value to seconds

Contributor

I have a extracted field call CallDuration and in logs it in format

%H:%M:%S.%2N like 00:00:38.60

That means the call duartion was 38.60 secs.

Now how can i convert that duartion to total number of seconds.??

If field value is 01:05:45.20
The new field should hold total duration in seconds ie. 3945.20sec

Tags (1)
1 Solution
SplunkTrust

Here's something to get you started:

``````eval duration=strptime(CallDuration,"%H:%M:%S.%2N") | eval base=strptime("00:00:00.00","%H:%M:%S.%2N") | eval secs=duration-base | table duration, secs
``````
---
If this reply helps you, Karma would be appreciated.
Communicator

There's now a convert function for this:

``````... | convert dur2sec(CallDuration) AS duration
``````
New Member

This answer is not valid, dur2sec does not support milliseconds. Proof: index=* | head 1 | eval CallDuration="00:00:38.60" | convert dur2sec(CallDuration) AS duration -> results in no duration field.

Communicator

The accepted answer should now be changed to this response since it is now a thing. SOOOO much cleaner and easier.

Communicator

totally agree

SplunkTrust

the following searchFu are example and you need to match them to your events, but you could do something like this:

``````... | rex field="_raw" "CallDuration: (?<hours>\d+)h:(?<minutes>\d+)m:(?<seconds>\d+)s" | eval CallDurationInSeconds = ((hours*60*60)+(minutes*60)+(seconds))
``````

or something like this if you have duration over or under one day:

``````... | rex field="_raw" "CallDuration: (?<dur_day>[0-9]+)?d? *(?<dur_hour>[0-9]+)h?:(?<dur_min>[0-9]+)m?" | eval connduration=(if(dur_day=="",0,dur_day)*1440*60)+(dur_hour * 60*60)+(dur_min*60)
``````

hope this helps ...

cheers, MuS

SplunkTrust

Here's something to get you started:

``````eval duration=strptime(CallDuration,"%H:%M:%S.%2N") | eval base=strptime("00:00:00.00","%H:%M:%S.%2N") | eval secs=duration-base | table duration, secs
``````
---
If this reply helps you, Karma would be appreciated.
Revered Legend

If you have many places where this conversion will take place, I would suggest to create a macro for it.

SplunkTrust

that's a nice one as well and I was typing for to long 🙂

Get Updates on the Splunk Community!

#### Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

#### Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! &#x1f308; In the United States, as well as many countries around the ...

#### SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...