Splunk Search

How to convert string time to show the number of seconds?

tamduong16
Contributor

I have a string time in double quote and would like to convert it into duration so that I could sum it later. This is the format of the string time:
alt text

How could I eliminate the quotes and convert it into duration.
Thanks!

0 Karma
1 Solution

somesoni2
Revered Legend

I can see your data contains double quotes, so you need to remove that and they use convert function to change it to number of seconds, like this (line 1 below is to generate sample data, replace it with your search OR just add 2nd line to your current search).

| gentimes start=-1 | eval "Call Duration"="\"2:30:00\"" | table "Call Duration" 
| eval "Call Duration"=replace('Call Duration',"\"","") | convert dur2sec("Call Duration") as "Call Duration" 

View solution in original post

somesoni2
Revered Legend

I can see your data contains double quotes, so you need to remove that and they use convert function to change it to number of seconds, like this (line 1 below is to generate sample data, replace it with your search OR just add 2nd line to your current search).

| gentimes start=-1 | eval "Call Duration"="\"2:30:00\"" | table "Call Duration" 
| eval "Call Duration"=replace('Call Duration',"\"","") | convert dur2sec("Call Duration") as "Call Duration" 

tamduong16
Contributor

thank you so much

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Try this: | makeresults | eval CallDuration = "02:30:00" | rex field=CallDuration "(?<hours>\d+):(?<minutes>\d+):(?<seconds>\d+)" | eval duration_minutes = ((hours*60)+minutes)

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...