Hi,
i need to write a query that converts time format from
minutes to format Xh Xmin Xs
my query
| eval finish_time_epoch = strftime(strptime(FINISH_TIME, "%Y-%m-%d %H:%M:%S"),"%Y-%m-%d %H:%M:%S")
| eval start_time_epoch = strftime(strptime(START_TIME, "%Y-%m-%d %H:%M:%S"),"%Y-%m-%d %H:%M:%S")
| eval duration_s = strptime(FINISH_TIME, "%Y-%m-%d %H:%M:%S") - strptime(START_TIME, "%Y-%m-%d %H:%M:%S")
| eval duration_min = round(duration_s / 60, 2)
| chart sum(duration_min) as "time" by Yd_count_data
Hi @Edwin1471,
if "time" is the duration expressed in minutes, you have to add at the end of your search an eval statement like the following:
| eval
time_hours=round(time/60,0),
time_min=round(time-time_hours*60,0),
time_sec=round((time-time_hours*60-time_min)*60,0)
| eval time=time_hours." h ".time_min." m ".time_sec
Ciao.
Giuseppe
Hi @Edwin1471,
if "time" is the duration expressed in minutes, you have to add at the end of your search an eval statement like the following:
| eval
time_hours=round(time/60,0),
time_min=round(time-time_hours*60,0),
time_sec=round((time-time_hours*60-time_min)*60,0)
| eval time=time_hours." h ".time_min." m ".time_sec
Ciao.
Giuseppe