Splunk Search

How to convert string time to show the number of seconds?

tamduong16
Contributor

I have a string time in double quote and would like to convert it into duration so that I could sum it later. This is the format of the string time:
alt text

How could I eliminate the quotes and convert it into duration.
Thanks!

0 Karma
1 Solution

somesoni2
Revered Legend

I can see your data contains double quotes, so you need to remove that and they use convert function to change it to number of seconds, like this (line 1 below is to generate sample data, replace it with your search OR just add 2nd line to your current search).

| gentimes start=-1 | eval "Call Duration"="\"2:30:00\"" | table "Call Duration" 
| eval "Call Duration"=replace('Call Duration',"\"","") | convert dur2sec("Call Duration") as "Call Duration" 

View solution in original post

somesoni2
Revered Legend

I can see your data contains double quotes, so you need to remove that and they use convert function to change it to number of seconds, like this (line 1 below is to generate sample data, replace it with your search OR just add 2nd line to your current search).

| gentimes start=-1 | eval "Call Duration"="\"2:30:00\"" | table "Call Duration" 
| eval "Call Duration"=replace('Call Duration',"\"","") | convert dur2sec("Call Duration") as "Call Duration" 

tamduong16
Contributor

thank you so much

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Try this: | makeresults | eval CallDuration = "02:30:00" | rex field=CallDuration "(?<hours>\d+):(?<minutes>\d+):(?<seconds>\d+)" | eval duration_minutes = ((hours*60)+minutes)

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...