Splunk Search

## How to convert large epoch time to hours minutes and seconds ?

Path Finder

I want to get the result of large epoch time to hours minutes and seconds.

Ex: Epoch time : 9386717.000000
Hours minutes seconds: 2607:25:17

How can I get the result?

Tags (3)
1 Solution
Champion

Hi

Check this

``````| makeresults
| eval total_seconds="9386717.000000"
| eval temp =tostring(total_seconds, "duration")
| rex field=temp "((?<days>^[^+]+)\+){0,1}(?P<hour>[^:]+):(?P<minutes>[^:]+):(?P<seconds>[^.]+)"
| eval day_to_hour=if(days>0,days*24+hour,days)
| eval output=if(days>0,day_to_hour.":".minutes.":".seconds,hour.":".minutes.":".seconds)
| table output
``````
Ultra Champion
``````| makeresults
| eval total_seconds="9386717.000000"
| eval Hours=floor(total_seconds / 60 /60), Minutes=floor((total_seconds%Hours)/60), Seconds=floor(total_seconds % 60)
``````

`How to convert large epoch time to hours minutes and seconds ?`
→ How to convert huge seconds to hours minutes and seconds?

Champion

Hi

Check this

``````| makeresults
| eval total_seconds="9386717.000000"
| eval temp =tostring(total_seconds, "duration")
| rex field=temp "((?<days>^[^+]+)\+){0,1}(?P<hour>[^:]+):(?P<minutes>[^:]+):(?P<seconds>[^.]+)"
| eval day_to_hour=if(days>0,days*24+hour,days)
| eval output=if(days>0,day_to_hour.":".minutes.":".seconds,hour.":".minutes.":".seconds)
| table output
``````
Ultra Champion

https://www.epochconverter.com/

Get Updates on the Splunk Community!

#### Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

#### Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

#### Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...