How to convert a string value in the format HH:mm:ss to usable seconds for a graph?

[mgranger1]

Hey Gang,

We are currently running Splunk Enterprise 6.3.1 on RHEL 6.x servers. I have a string value that I have brought in from a long that represents hours, minutes, and seconds in the form HH:mm:ss, and the user would like to graph the trend of the duration. The easiest way that I can think of to do this would be to convert this string into a number of seconds so that I could represent a single numeric value to graph. Does anyone have an easy way to do this, or an alternate way to graph HH:mm:ss? Thanks, in advance for any help you may be able to provide.

[sundareshr]

Have you tried convert command?

... | convert dur2sec(HHMMSSFormattedText) as seconds

[mgranger1]

Okay, now for a follow up. Is there a way to graph the duration in it's HH:mm:ss format? The end user doesn't like the idea of showing her management the duration in total seconds as she feels management will be confused. I know this is a long shot, but if it was 01:15:30 (i.e. one hour, fifteen minutes and 30 seconds), she would like the graph to be numbered somehow as 1:15:30 and not 4530 seconds.

[sundareshr]

Try the convert AFTER the chart command.

[mgranger1]

This worked like a charm. I couldn't believe it was that easy. Thank you so much for this simple and efficient answer. You've saved me a boatload of time!

[somesoni2]

I think the way to go will be convert this to seconds and chart it. The value should be numerical to be charted so string formatted duration wouldn't work. Something like this should work.

your base search | eval yourDurationField=strptime("01/01/2016 ".yourDurationField,"%m/%d/%Y %H:%M:%S") - strptime("01/01/2016 ","%m/%d/%Y") | your chart command...