Splunk Search

## How to convert large epoch time to hours minutes and seconds ?

Path Finder

I want to get the result of large epoch time to hours minutes and seconds.

Ex: Epoch time : 9386717.000000
Hours minutes seconds: 2607:25:17

How can I get the result?

Tags (3)
1 Solution
Champion

Hi

Check this

``````| makeresults
| eval total_seconds="9386717.000000"
| eval temp =tostring(total_seconds, "duration")
| rex field=temp "((?<days>^[^+]+)\+){0,1}(?P<hour>[^:]+):(?P<minutes>[^:]+):(?P<seconds>[^.]+)"
| eval day_to_hour=if(days>0,days*24+hour,days)
| eval output=if(days>0,day_to_hour.":".minutes.":".seconds,hour.":".minutes.":".seconds)
| table output
``````
Ultra Champion
``````| makeresults
| eval total_seconds="9386717.000000"
| eval Hours=floor(total_seconds / 60 /60), Minutes=floor((total_seconds%Hours)/60), Seconds=floor(total_seconds % 60)
``````

`How to convert large epoch time to hours minutes and seconds ?`
→ How to convert huge seconds to hours minutes and seconds?

Champion

Hi

Check this

``````| makeresults
| eval total_seconds="9386717.000000"
| eval temp =tostring(total_seconds, "duration")
| rex field=temp "((?<days>^[^+]+)\+){0,1}(?P<hour>[^:]+):(?P<minutes>[^:]+):(?P<seconds>[^.]+)"
| eval day_to_hour=if(days>0,days*24+hour,days)
| eval output=if(days>0,day_to_hour.":".minutes.":".seconds,hour.":".minutes.":".seconds)
| table output
``````
Ultra Champion

https://www.epochconverter.com/

Get Updates on the Splunk Community!

#### Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

#### Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

#### Adoption of RUM and APM at Splunk

Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...