Splunk Search

How do you Insert Hour, Mins & Seconds in an extracted time?

cquinney
Communicator

I have a table that populates something to the effect of:

Name           Start Time              End Time          Run Time Duration
Test               15:40:39                15:45:39                   00:05:00

What I'm trying to create is the following under Run Time Duration = 00H 05Min 00Secs

Any assistance in resolving this would be greatly appreciated.

0 Karma
1 Solution

vnravikumar
Champion

Hi @cquinney

Try this

| makeresults 
| eval "Run Time Duration"="00:05:00" 
| rex field="Run Time Duration" "(?P<Hr>\d\d):(?P<Min>\d\d):(?P<Sec>\d\d)" 
| eval "Run Time Duration" = Hr."H"." ".Min."Min"." ".Sec."Secs"

View solution in original post

vnravikumar
Champion

Hi @cquinney

Try this

| makeresults 
| eval "Run Time Duration"="00:05:00" 
| rex field="Run Time Duration" "(?P<Hr>\d\d):(?P<Min>\d\d):(?P<Sec>\d\d)" 
| eval "Run Time Duration" = Hr."H"." ".Min."Min"." ".Sec."Secs"

cquinney
Communicator

Works perfectly! Thank you!!

0 Karma
Get Updates on the Splunk Community!

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...