How to convert seconds to days?

[mark_chuman]

This search:

index=perfstats host=hostname | chart max(System_Up_Time) as "System Uptime" by host

Outputs a value such as this:

85486.676230500001

Just trying to convert this value in seconds to days.

Thanks. Looked at different posts, but can't seem to convert it effectively.

[Raja]

perfect

[pradeepkumarg]

All that you need is an eval command to do the math and store in a new field

index=perfstats host=hostname | eval Uptime_Days = System_Up_Time/86400 | chart max(Uptime_Days) as "System Uptime" by host

[martin_mueller]

The tostring() takes seconds, you've fed it with days. Pick only one way of conversion, not both at once.

[mark_chuman]

Tried to ensure I'm not using multiple conversions at once by using these two searches:

index=perfstats host=hostname | eval Uptime_Days = System_Up_Time | chart max(Uptime_Days) as "System Uptime" by host | eval System Uptime = tostring('System Uptime', "duration")

index=perfstats host=hostname | chart max(Uptime_Days) as "System Uptime" by host | eval System Uptime = tostring('System Uptime', "duration")

No data found on both. Just an FYI, no need to reply if you don't want. The initial reply is good.

[martin_mueller]

Another neat thing is this after the chart:

... | eval System Uptime = tostring('System Uptime', "duration")

That will provide a readable string with days, hours, minutes, ...

[mark_chuman]

you mean like this?

index=perfstats host=hostname | eval Uptime_Days = System_Up_Time/86400 | chart max(Uptime_Days) as "System Uptime" by host | eval System Uptime = tostring('System Uptime', "duration")

I get data like this

00:00:17.723748506149999

Thanks

[mark_chuman]

Thanks very much.

[Raja]

Any idea on how to use round function after 17.723748506149999  like 17.72 
when I use round function values no results found.

[PickleRick]

Firstly, a golden shovel award 😉 you dug up a thread from 8 years ago 😄

But seriously. If you have a field which looks like a number but doesn't work like a number (nummerical functions don't give you expected results), you're probably dealing with a text field containing string representation of a number. You have to convert it to number first.

| makeresults
| eval stringfield="17.1654923"
| eval bad=round(stringfield,2)
| eval good=round(tonumber(stringfield),2)

[somesoni2]

Try like this

| eval System Uptime = tostring(round('System Uptime',2), "duration")