Splunk Search

How to convert decimal time to a human readable format in a search?

vince2010091
Path Finder

Hello,

I've a decimal time in my logs like 1.51 that equal 1h30/1:30 or 4.3 equal 4h20/4:20

So i try to get a normal/human time with an eval:
eval TimeHour=floor(TimeBase) |
eval TimeMin=(TimeBase-TimeHour)*0.6 |
eval Time=TimeHour+TimeMin

For entry 1.5 i get 1.3 what is good but not perfect because i need 1:30

I've tried to convert it with strptime and strftime but i get 1:03 and not 1:30

eval TimeFormated=strftime(strptime(Time, "%H.%M"),"%H:%M")

I've didn't found any time format for base10 time or for minutes without leading zero

Thanks for help,

Regards,
Vincent

0 Karma
1 Solution

vince2010091
Path Finder

Hello, this isn't working but i added a round and now it's working fine

eval TimeMin=round((TimeBase-TimeHour)*0.6, 2) |

View solution in original post

0 Karma

vince2010091
Path Finder

Hello, this isn't working but i added a round and now it's working fine

eval TimeMin=round((TimeBase-TimeHour)*0.6, 2) |

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You were this close:

eval TimeHour=floor(TimeBase) | eval TimeMin=(TimeBase-TimeHour)*60 | eval Time=TimeHour.":".TimeMin
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...