Splunk Search

How do I convert a time duration to a number?

kranthimutyala
Path Finder

Hi Team,

I have a field which has the values in the below string format:  HH:MM:SS.3N

0:00:43.096

22:09:50.174

1:59:54.382

5:41:21.623

0:01:56.597

I want to convert the whole duration into minutes and anything under a min is considered 1 minute

Labels (4)
Tags (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @kranthimutyala,

you have to extract the hours value using a regex and then use an eval, something like this:

<your_search>
| rex field=your_duration "^(?<hours>\d+):(?<minutes>\d+):(?<seconds>\d+)\.(?<milliseconds>\d+)"
| eval duration_in_minutes=hours*60+minutes+if(seconds>0 OR milliseconds>0,1,0)
| table duration_in_minutes 

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @kranthimutyala,

you have to extract the hours value using a regex and then use an eval, something like this:

<your_search>
| rex field=your_duration "^(?<hours>\d+):(?<minutes>\d+):(?<seconds>\d+)\.(?<milliseconds>\d+)"
| eval duration_in_minutes=hours*60+minutes+if(seconds>0 OR milliseconds>0,1,0)
| table duration_in_minutes 

Ciao.

Giuseppe

gcusello
SplunkTrust
SplunkTrust

Hi @kranthimutyala,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma

kranthimutyala
Path Finder

Karma and given, one more question from my end which can earn you more 
https://community.splunk.com/t5/Splunk-Search/Help-with-extracting-JSON-fields/m-p/614290#M213452

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...