Splunk Search

Converting [h]:mm:ss into hour, minutes and seconds

CarmineCalo
Path Finder

Splunkers!

How should i modify the regula expression

| rex field=duration "(?<hour>\d{2}):(?<min>\d{2}):(?<sec>\d{2})"

to be able to convert in the same time into hours, minutes and seconds time value like
1;20:15 or 11:20:15?

Final goal is to calculate duration in seconds, with this simple codeline

| eval duration_h = hour+min/60+sec/3600

Currently code it is working only for the second format (values having hours with only 1 char are not converted).

Tks!
Carmine

0 Karma
1 Solution

JordanPeterson
Path Finder

When using the curly braces you're telling RegEx to look for exactly two digits. If you want one or two digits try this:

| rex field=duration "(?<hour>\d{1,2}):(?<min>\d{2}):(?<sec>\d{2})"

View solution in original post

mayurr98
Super Champion

hey, you do not need to extract hour minute and sec and write eval for conversion, as there is already a ready-made conversion command called convert. If you do not have field which is in HH:MM:SS format then you can write | eval time=strftime(strptime(time,"%Y/%m/%d %H:%M:%S"),"%H:%M:%S") OR you can use regex which you already have and then write convert command.

Try this run anywhere search

| makeresults 
| eval time="14:50:40"
| convert dur2sec(time) as duration

In your environment, you should write

<your_base_search> 
| convert dur2sec(time) as duration

For more information, have a look at this doc:
https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Convert

let me know if it helps!

0 Karma

493669
Super Champion

to convert duration into hour, min and sec try below:

 | rex field=duration "(?<hour>\d{1,2}):(?<min>\d{1,2}):(?<sec>\d{2})"

and to convert into seconds :

| eval duration_s = (hour*3600)+(min*60)+sec
0 Karma

JordanPeterson
Path Finder

When using the curly braces you're telling RegEx to look for exactly two digits. If you want one or two digits try this:

| rex field=duration "(?<hour>\d{1,2}):(?<min>\d{2}):(?<sec>\d{2})"
Get Updates on the Splunk Community!

This Week's Community Digest - Splunk Community Happenings [9.26.22]

Get the latest news and updates from the Splunk Community here! Upcoming User Group Events! &#x1f44f; Check ...

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...