Hi Team,
I have a field which has the values in the below string format: HH:MM:SS.3N
0:00:43.096
22:09:50.174
1:59:54.382
5:41:21.623
0:01:56.597
I want to convert the whole duration into minutes and anything under a min is considered 1 minute
Hi @kranthimutyala,
you have to extract the hours value using a regex and then use an eval, something like this:
<your_search>
| rex field=your_duration "^(?<hours>\d+):(?<minutes>\d+):(?<seconds>\d+)\.(?<milliseconds>\d+)"
| eval duration_in_minutes=hours*60+minutes+if(seconds>0 OR milliseconds>0,1,0)
| table duration_in_minutes
Ciao.
Giuseppe
Hi @kranthimutyala,
you have to extract the hours value using a regex and then use an eval, something like this:
<your_search>
| rex field=your_duration "^(?<hours>\d+):(?<minutes>\d+):(?<seconds>\d+)\.(?<milliseconds>\d+)"
| eval duration_in_minutes=hours*60+minutes+if(seconds>0 OR milliseconds>0,1,0)
| table duration_in_minutes
Ciao.
Giuseppe
Hi @kranthimutyala,
good for you, see next time!
Ciao and happy splunking
Giuseppe
P.S.: Karma Points are appreciated 😉
Karma and given, one more question from my end which can earn you more
https://community.splunk.com/t5/Splunk-Search/Help-with-extracting-JSON-fields/m-p/614290#M213452