Splunk Search

How to convert time format?

ashanka
Explorer

I have a column duration with this time format: 01:20:00.000000.
How do I convert time format from 01:20:00.000000 to "1 Hr 20 Mins"?

0 Karma
1 Solution

jeffland
SplunkTrust
SplunkTrust

If you're looking for an easy way, you could go with

| eval output = replace(input, "0?(\d+):0?(h+).*", "\1 Hr \2 Min")

This replaces the entire content of the field (as the regex matches it entirely via .*) while capturing hours and minutes disregarding leading zeroes and outputs those numbers with fixed Hr and Min strings. I hope you see where this is going, if you wanted to add seconds it'd be

| eval output = replace(input, "0?(\d+):0?(h+):(\d+).*", "\1 Hr \2 Min \3 Sec")

and so on. You could also do it more elaborately by capturing those values with rex and creating a new field like this:

| rex field=input "0?(?<hours>\d+):0?(?<minutes>\d+)"
| eval output = hours . " Hr" . if(hours > 1, "s ", " ") . minutes . "Min" . if(minutes > 1, "s ", " ")

This allows you to add an "s" to Hr and Min if it's more than one.

View solution in original post

0 Karma

jeffland
SplunkTrust
SplunkTrust

If you're looking for an easy way, you could go with

| eval output = replace(input, "0?(\d+):0?(h+).*", "\1 Hr \2 Min")

This replaces the entire content of the field (as the regex matches it entirely via .*) while capturing hours and minutes disregarding leading zeroes and outputs those numbers with fixed Hr and Min strings. I hope you see where this is going, if you wanted to add seconds it'd be

| eval output = replace(input, "0?(\d+):0?(h+):(\d+).*", "\1 Hr \2 Min \3 Sec")

and so on. You could also do it more elaborately by capturing those values with rex and creating a new field like this:

| rex field=input "0?(?<hours>\d+):0?(?<minutes>\d+)"
| eval output = hours . " Hr" . if(hours > 1, "s ", " ") . minutes . "Min" . if(minutes > 1, "s ", " ")

This allows you to add an "s" to Hr and Min if it's more than one.

0 Karma

ashanka
Explorer

Is this possible?

0 Karma

ashanka
Explorer
| eval startTime=strptime(startTime,"%Y-%m-%d %H:%M") 
| eval endTime=strptime(endTime,"%Y-%m-%d %H:%M") 
| eval MTTR=tostring((endTime-startTime),"duration")

This is how i got the duration

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...