Splunk Search

How to convert milliseconds to minutes or seconds

Explorer
base search | spath "body.totalTime" | search "body.totalTime"=426287

How to convert milliseconds to minutes or seconds?

0 Karma
1 Solution

Esteemed Legend

Like this:

base search 
| spath "body.totalTime" 
| search "body.totalTime"=426287
| fieldformat "body.totalTime" = round(('body.totalTime' / 1000), 3)

View solution in original post

0 Karma

Esteemed Legend

Like this:

base search 
| spath "body.totalTime" 
| search "body.totalTime"=426287
| fieldformat "body.totalTime" = round(('body.totalTime' / 1000), 3)

View solution in original post

0 Karma

Champion

Hi

Try this

....| eval inSeconds = round('body.totalTime' / 1000,2) 
| eval output = tostring(inSeconds, "duration")
0 Karma

Esteemed Legend

Like this:

base search 
| spath "body.totalTime" 
| search "body.totalTime"=426287
| fieldformat "body.totalTime" = tostring('body.totalTime' / 1000, "duration")
0 Karma

Explorer

@woodcock ck :Tried this one

base search | search "body.totalTime"=82534 | fieldformat "body.totalTime" = tostring('body.totalTime' / 1000, "duration") | table body.totalTime

Result I am getting like this 00:01:22.534000000000006 instead of 82.534 sec

Esteemed Legend

I was giving you what I thought was a "better" answer. See my new answer for the "exact" answer to what you asked.

0 Karma

Communicator

try this

base search|spath "body.totalTime" | eval body.seconds=body.totalTime*1000 | eval body.minutes=body.seconds*60
|table body.totalTime, body.seconds, body.minutes

0 Karma