Help with dur2sec function not displaying

[PBerry7538]

Hi
I am having an issue with the result of my dur2sec function not displaying.
Here is the SPL. I am still new to splunk so have put what I believe I am doing alongside the query.

|eval Entrytimestamp=strptime(ENTRY, "%d.%m.%Y %H:%M:%S") -- convert the ENTRY field date string to a proper date format
|eval dwellTime_S = tostring(now()-Entrytimestamp,"duration") -- get the duration string and assign it to variable dwellTime_S
|convert dur2sec(dwellTime_S) AS dwellTime_C -- convert the dwellTime string variable to seconds and assign to dwellTime_C variable

When i then use the dwellTime_C in a table the column is blank. Please can anyone help and advise where I am going wrong ?

Many Thanks

PS: I am not in the office tomorrow so wont be able to reply immediately.

[richgalloway · Accepted solution]

Why not skip the middle step? now()-Entrytimestamp is in seconds so there's no need to convert.

| eval Entrytimestamp=strptime(ENTRY, "%d.%m.%Y %H:%M:%S")
| eval dwellTime_C = now()-Entrytimestamp
| eval dwellTime_S = tostring(dwellTime_C, "duration")

[PBerry7538]

Thanks Rich