How do I convert a time duration to a number?

[kranthimutyala]

Hi Team,

I have a field which has the values in the below string format:  HH:MM:SS.3N

0:00:43.096

22:09:50.174

1:59:54.382

5:41:21.623

0:01:56.597

I want to convert the whole duration into minutes and anything under a min is considered 1 minute

[gcusello · Accepted solution]

Hi @kranthimutyala,

you have to extract the hours value using a regex and then use an eval, something like this:

<your_search>
| rex field=your_duration "^(?<hours>\d+):(?<minutes>\d+):(?<seconds>\d+)\.(?<milliseconds>\d+)"
| eval duration_in_minutes=hours*60+minutes+if(seconds>0 OR milliseconds>0,1,0)
| table duration_in_minutes 

Ciao.

Giuseppe

[gcusello]

Hi @kranthimutyala,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

[kranthimutyala]

Karma and given, one more question from my end which can earn you more 
https://community.splunk.com/t5/Splunk-Search/Help-with-extracting-JSON-fields/m-p/614290#M213452