How to convert epoch to H:M:S?

[auaave]

Hi Guys,

I have the below time formats that I converted to epoch to get the difference.
START - "04-30-2018 16:17:09"
END - "2018-04-30 16:17:19.072"

I used the below query but the difference/ duration doesn't display properly. It displays 10:00:10 instead of 00:00:10, 10:10:10 instead of 00:10:10. How can I fix this? Thanks!

| eval end=strptime(END,"%Y-%m-%d %H:%M:%S") |eval start=strptime(START,"%m-%d-%Y %H:%M:%S") |eval DURATION=(end-start) |table start end DURATION | eval DURATION=strftime(DURATION, "%H:%M:%S")

[xpac]

Hey,

try this:

| makeresults 
| eval START="04-30-2018 16:17:09"
| eval END="2018-04-30 16:17:19.072" 
| eval end=strptime(END,"%Y-%m-%d %H:%M:%S") 
| eval start=strptime(START,"%m-%d-%Y %H:%M:%S") 
| eval DURATION=(end-start) 
| table start end DURATION
| fieldformat DURATION=tostring(DURATION, "duration")
| eval DURATION=replace(DURATION, "\.000000", "")

Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂

[auaave]

thanks @xpac! This work for me as well but I didn't use the |make results 🙂

[xpac]

The makeresults part is only used to create fake events because we don't have your data available 😉
Happy it worked out for you 🙂

[skoelpin]

You should do the DURATION math before converting to string format time.

|eval DURATION=('end'-'start') 
| eval DURATION=strftime(DURATION, "%H:%M:%S")
|table start end DURATION 

[auaave]

Thanks @skoelpin, I tried this but still got the 10: in front. 😞

[p_gurav · Accepted solution]

Can you try :

| eval end=strptime(END,"%Y-%m-%d %H:%M:%S") |eval start=strptime(START,"%m-%d-%Y %H:%M:%S") |eval DURATION=(end-start) |table start end DURATION | eval DURATION=tostring(DURATION, "duration")

[auaave]

Thank you @ p_gurav! This works for me 🙂