How do I convert duration to minutes

[gill1723]

index=main host=10.247.82.1 user=* | rex field=duration "((?\d+)h:)?(?\d+)m:(?\d+)s" | eval duration=duration_second+60*duration_minute+3600*coalesce(duration_hour,0) | stats sum(duration) as total_duration by Username, date_month, date_mday | bin _time span=1d

Results:
date month total duration
april 24 2657

[richgalloway · Accepted solution]

Try this.

index=main host=10.247.82.1 user=* | rex field=duration "((?<duration_hour>\d+)h:)?(?<duration_minute>\d+)m:(?<duration_second>\d+)s" | eval duration=duration_second+60*duration_minute+3600*coalesce(duration_hour,0) | stats sum(duration) as total_duration by Username, date_month, date_mday | bin _time span=1d | eval total_duration=tostring(total_duration, "duration")

[rbansql104]

how can I declare a metrics in which I have the data like 30 days 10 hours 16 minutes have to be converted into seconds?

[gill1723]

I get this error when I run that script

⚠ Error in 'rex' command: Encountered the following error while compiling the regex '((?\d+)h:)?(?\d+)m:(?\d+)s': Regex: unrecognized character after (? or (?-

[richgalloway]

That's because I copied the search after the forum munged it. I've corrected my answer.

[gill1723]

This works great thanks a bunch.

[gill1723]

I need to convert this to HH:MM:SS

index=main host=10.247.82.1 user=* | rex field=duration "((?\d+)h:)?(?\d+)m:(?\d+)s" | eval duration=duration_second+60*duration_minute+3600*coalesce(duration_hour,0) | stats sum(duration) as total_duration by Username, date_month, date_mday | bin _time span=1d

[p_gurav]

Can you try something:

| convert dur2sec(duration) as duration_sec |eval min=duration_sec/60

[gill1723]

Sorry I need to convert it to HH:MM:SS

index=main host=10.247.82.1 user=* | rex field=duration "((?\d+)h:)?(?\d+)m:(?\d+)s" | eval duration=duration_second+60*duration_minute+3600*coalesce(duration_hour,0) | stats sum(duration) as total_duration by Username, date_month, date_mday | bin _time span=1d

[p_gurav]

Also refer doc:
https://docs.splunk.com/Documentation/Splunk/7.0.3/SearchReference/Convert#1._Convert_sendmail_durat...