index=main host=10.247.82.1 user=* | rex field=duration "((?\d+)h:)?(?\d+)m:(?\d+)s" | eval duration=duration_second+60*duration_minute+3600*coalesce(duration_hour,0) | stats sum(duration) as total_duration by Username, date_month, date_mday | bin _time span=1d
Results:
date month total duration
april 24 2657
Try this.
index=main host=10.247.82.1 user=* | rex field=duration "((?<duration_hour>\d+)h:)?(?<duration_minute>\d+)m:(?<duration_second>\d+)s" | eval duration=duration_second+60*duration_minute+3600*coalesce(duration_hour,0) | stats sum(duration) as total_duration by Username, date_month, date_mday | bin _time span=1d | eval total_duration=tostring(total_duration, "duration")
Try this.
index=main host=10.247.82.1 user=* | rex field=duration "((?<duration_hour>\d+)h:)?(?<duration_minute>\d+)m:(?<duration_second>\d+)s" | eval duration=duration_second+60*duration_minute+3600*coalesce(duration_hour,0) | stats sum(duration) as total_duration by Username, date_month, date_mday | bin _time span=1d | eval total_duration=tostring(total_duration, "duration")
how can I declare a metrics in which I have the data like 30 days 10 hours 16 minutes have to be converted into seconds?
I get this error when I run that script
⚠ Error in 'rex' command: Encountered the following error while compiling the regex '((?\d+)h:)?(?\d+)m:(?\d+)s': Regex: unrecognized character after (? or (?-
That's because I copied the search after the forum munged it. I've corrected my answer.
This works great thanks a bunch.
I need to convert this to HH:MM:SS
index=main host=10.247.82.1 user=* | rex field=duration "((?\d+)h:)?(?\d+)m:(?\d+)s" | eval duration=duration_second+60*duration_minute+3600*coalesce(duration_hour,0) | stats sum(duration) as total_duration by Username, date_month, date_mday | bin _time span=1d
Can you try something:
| convert dur2sec(duration) as duration_sec |eval min=duration_sec/60
Sorry I need to convert it to HH:MM:SS
index=main host=10.247.82.1 user=* | rex field=duration "((?\d+)h:)?(?\d+)m:(?\d+)s" | eval duration=duration_second+60*duration_minute+3600*coalesce(duration_hour,0) | stats sum(duration) as total_duration by Username, date_month, date_mday | bin _time span=1d