Splunk Search

How to convert time format?

ashanka
Explorer

I have a column duration with this time format: 01:20:00.000000.
How do I convert time format from 01:20:00.000000 to "1 Hr 20 Mins"?

0 Karma
1 Solution

jeffland
SplunkTrust
SplunkTrust

If you're looking for an easy way, you could go with

| eval output = replace(input, "0?(\d+):0?(h+).*", "\1 Hr \2 Min")

This replaces the entire content of the field (as the regex matches it entirely via .*) while capturing hours and minutes disregarding leading zeroes and outputs those numbers with fixed Hr and Min strings. I hope you see where this is going, if you wanted to add seconds it'd be

| eval output = replace(input, "0?(\d+):0?(h+):(\d+).*", "\1 Hr \2 Min \3 Sec")

and so on. You could also do it more elaborately by capturing those values with rex and creating a new field like this:

| rex field=input "0?(?<hours>\d+):0?(?<minutes>\d+)"
| eval output = hours . " Hr" . if(hours > 1, "s ", " ") . minutes . "Min" . if(minutes > 1, "s ", " ")

This allows you to add an "s" to Hr and Min if it's more than one.

View solution in original post

0 Karma

jeffland
SplunkTrust
SplunkTrust

If you're looking for an easy way, you could go with

| eval output = replace(input, "0?(\d+):0?(h+).*", "\1 Hr \2 Min")

This replaces the entire content of the field (as the regex matches it entirely via .*) while capturing hours and minutes disregarding leading zeroes and outputs those numbers with fixed Hr and Min strings. I hope you see where this is going, if you wanted to add seconds it'd be

| eval output = replace(input, "0?(\d+):0?(h+):(\d+).*", "\1 Hr \2 Min \3 Sec")

and so on. You could also do it more elaborately by capturing those values with rex and creating a new field like this:

| rex field=input "0?(?<hours>\d+):0?(?<minutes>\d+)"
| eval output = hours . " Hr" . if(hours > 1, "s ", " ") . minutes . "Min" . if(minutes > 1, "s ", " ")

This allows you to add an "s" to Hr and Min if it's more than one.

0 Karma

ashanka
Explorer

Is this possible?

0 Karma

ashanka
Explorer
| eval startTime=strptime(startTime,"%Y-%m-%d %H:%M") 
| eval endTime=strptime(endTime,"%Y-%m-%d %H:%M") 
| eval MTTR=tostring((endTime-startTime),"duration")

This is how i got the duration

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...