Splunk Search

How to convert duration in seconds to [h]:mm:ss?

Communicator

Hi,

I have a table with duration in seconds, how can I convert it to [h]:mm:ss? I want it to count the number of hours even if it is more than 1 day. Thanks!

Here is my query.

| dedup IDEVENT
| where _time>relative_time(now(),"-4w@w")
| bin _time span=1w
| stats sum(DURATION) as eventduration by DESCRIPTION _time
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi

Can you please try | eval time=strftime(_time, "%H:%M:%S") or you can try | eval time=tostring(_time,"duration")

So your query will be

 | dedup IDEVENT
 | where _time>relative_time(now(),"-4w@w")
 | bin _time span=1w
 | stats sum(DURATION) as eventduration by DESCRIPTION _time
 | eval time=strftime(_time, "%H:%M:%S")

and with second approach

 | dedup IDEVENT
 | where _time>relative_time(now(),"-4w@w")
 | bin _time span=1w
 | stats sum(DURATION) as eventduration by DESCRIPTION _time
 | eval time=tostring(_time,"duration")

View solution in original post

SplunkTrust
SplunkTrust

Hi

Can you please try | eval time=strftime(_time, "%H:%M:%S") or you can try | eval time=tostring(_time,"duration")

So your query will be

 | dedup IDEVENT
 | where _time>relative_time(now(),"-4w@w")
 | bin _time span=1w
 | stats sum(DURATION) as eventduration by DESCRIPTION _time
 | eval time=strftime(_time, "%H:%M:%S")

and with second approach

 | dedup IDEVENT
 | where _time>relative_time(now(),"-4w@w")
 | bin _time span=1w
 | stats sum(DURATION) as eventduration by DESCRIPTION _time
 | eval time=tostring(_time,"duration")

View solution in original post

Communicator

@harsmarvania57 , thanks! The second approach works! 🙂

0 Karma

SplunkTrust
SplunkTrust

@auaave, Glad to hear that it worked, please accept my answer and upvote it. 🙂

0 Karma

Champion

Hi Auaave,

You can use strftime function using eval. For eg.
eval eventduration=strftime(eventduration,"%H:%M:%S")

0 Karma

Communicator

@p_gurav, thanks for your reply. 🙂

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!