Splunk Search

How to convert a string value in the format HH:mm:ss to usable seconds for a graph?

mgranger1
Path Finder

Hey Gang,

We are currently running Splunk Enterprise 6.3.1 on RHEL 6.x servers. I have a string value that I have brought in from a long that represents hours, minutes, and seconds in the form HH:mm:ss, and the user would like to graph the trend of the duration. The easiest way that I can think of to do this would be to convert this string into a number of seconds so that I could represent a single numeric value to graph. Does anyone have an easy way to do this, or an alternate way to graph HH:mm:ss? Thanks, in advance for any help you may be able to provide.

0 Karma

sundareshr
Legend

Have you tried convert command?

... | convert dur2sec(HHMMSSFormattedText) as seconds

mgranger1
Path Finder

Okay, now for a follow up. Is there a way to graph the duration in it's HH:mm:ss format? The end user doesn't like the idea of showing her management the duration in total seconds as she feels management will be confused. I know this is a long shot, but if it was 01:15:30 (i.e. one hour, fifteen minutes and 30 seconds), she would like the graph to be numbered somehow as 1:15:30 and not 4530 seconds.

0 Karma

sundareshr
Legend

Try the convert AFTER the chart command.

0 Karma

mgranger1
Path Finder

This worked like a charm. I couldn't believe it was that easy. Thank you so much for this simple and efficient answer. You've saved me a boatload of time!

0 Karma

somesoni2
SplunkTrust
SplunkTrust

I think the way to go will be convert this to seconds and chart it. The value should be numerical to be charted so string formatted duration wouldn't work. Something like this should work.

your base search | eval yourDurationField=strptime("01/01/2016 ".yourDurationField,"%m/%d/%Y %H:%M:%S") - strptime("01/01/2016 ","%m/%d/%Y") | your chart command...
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...