Converting Duration Field value to seconds

[adityapavan18]

I have a extracted field call CallDuration and in logs it in format

%H:%M:%S.%2N like 00:00:38.60

That means the call duartion was 38.60 secs.

Now how can i convert that duartion to total number of seconds.??

If field value is 01:05:45.20
The new field should hold total duration in seconds ie. 3945.20sec

[gpullis]

There's now a convert function for this:

... | convert dur2sec(CallDuration) AS duration

[bugmenot]

This answer is not valid, dur2sec does not support milliseconds. Proof: index=* | head 1 | eval CallDuration="00:00:38.60" | convert dur2sec(CallDuration) AS duration -> results in no duration field.

[MattZerfas]

The accepted answer should now be changed to this response since it is now a thing. SOOOO much cleaner and easier.

[MedralaG]

totally agree

[MuS]

Hi adityapavan18,

the following searchFu are example and you need to match them to your events, but you could do something like this:

... | rex field="_raw" "CallDuration: (?<hours>\d+)h:(?<minutes>\d+)m:(?<seconds>\d+)s" | eval CallDurationInSeconds = ((hours*60*60)+(minutes*60)+(seconds))

or something like this if you have duration over or under one day:

... | rex field="_raw" "CallDuration: (?<dur_day>[0-9]+)?d? *(?<dur_hour>[0-9]+)h?:(?<dur_min>[0-9]+)m?" | eval connduration=(if(dur_day=="",0,dur_day)*1440*60)+(dur_hour * 60*60)+(dur_min*60)

hope this helps ...

cheers, MuS

[richgalloway · Accepted solution]

Here's something to get you started:

eval duration=strptime(CallDuration,"%H:%M:%S.%2N") | eval base=strptime("00:00:00.00","%H:%M:%S.%2N") | eval secs=duration-base | table duration, secs

[somesoni2]

If you have many places where this conversion will take place, I would suggest to create a macro for it.

[MuS]

that's a nice one as well and I was typing for to long 🙂