Splunk Search

How to convert time as DD:HH:MM:SS

New Member

How can I convert 2+12:54:32 as 2:12:54:32 (2 days 12 hours 54 minutes 32 seconds)

Current search is this :

| eval duration_time= tostring(duration_time, "duration")
| eval formatted_dur = replace(duration_time,"(?:(\d+)+)?0?(\d+):0?(\d+):0?(\d+)","\1d \2h \3m \4s")

Which produces attached screenshots.. When we are sorting from highest time --> to lowest time .. it puts days as the lowest in the sort.alt text

0 Karma


Try this:

... your root search ... 
| rex field=duration_time "(?<days>\d+)?\+?(?<hours>\d+):(?<minutes>\d+):(?<seconds>\d+)\.(?<micro>\d+)" 
| eval elapsed=86400*days+3600*hours+60*minutes+seconds 
| table elapsed duration_time 
| sort elapsed

If that looks good, add this to the end to remove the elapsed field:

| fields - elapsed
0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...