Splunk Search

How to convert the output of tostring or convert a duration field?

jameswatts
Explorer

I have a search that returns the diff of two times, but the user wants it in "1 day 5 hours and 23 minutes" format not 00+00:00:00. I know regex can do this, but the possibility that the day value might not be present has me stumped. Any help appreciated.

0 Karma
1 Solution

somesoni2
Revered Legend

Try something like this (run anywhere example)

| gentimes start=-1 | eval diff=round(now()-relative_time(now(),"-2h")) | table diff | eval duration=tostring(diff,"duration") | eval duration2=replace(duration,"(\d*)\+*(\d+):(\d+):(\d+)","\1 days \2 hours \3 minutes \4 secs")

View solution in original post

somesoni2
Revered Legend

Try something like this (run anywhere example)

| gentimes start=-1 | eval diff=round(now()-relative_time(now(),"-2h")) | table diff | eval duration=tostring(diff,"duration") | eval duration2=replace(duration,"(\d*)\+*(\d+):(\d+):(\d+)","\1 days \2 hours \3 minutes \4 secs")

benhooper
Communicator

The following regex can be used to suppress any trailing substrings:

(\d*)\+*(\d+):(\d+):(\d+)(.*)
0 Karma

jameswatts
Explorer

Perfect! Thanks much.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...