Splunk Search
Highlighted

How to convert decimal time to a human readable format in a search?

Path Finder

Hello,

I've a decimal time in my logs like 1.51 that equal 1h30/1:30 or 4.3 equal 4h20/4:20

So i try to get a normal/human time with an eval:
eval TimeHour=floor(TimeBase) |
eval TimeMin=(TimeBase-TimeHour)*0.6 |
eval Time=TimeHour+TimeMin

For entry 1.5 i get 1.3 what is good but not perfect because i need 1:30

I've tried to convert it with strptime and strftime but i get 1:03 and not 1:30

eval TimeFormated=strftime(strptime(Time, "%H.%M"),"%H:%M")

I've didn't found any time format for base10 time or for minutes without leading zero

Thanks for help,

Regards,
Vincent

0 Karma
Highlighted

Re: How to convert decimal time to a human readable format in a search?

SplunkTrust
SplunkTrust

You were this close:

eval TimeHour=floor(TimeBase) | eval TimeMin=(TimeBase-TimeHour)*60 | eval Time=TimeHour.":".TimeMin
---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: How to convert decimal time to a human readable format in a search?

Path Finder

Hello, this isn't working but i added a round and now it's working fine

eval TimeMin=round((TimeBase-TimeHour)*0.6, 2) |

View solution in original post

0 Karma