How to convert time format?

[ashanka]

I have a column duration with this time format: 01:20:00.000000.
How do I convert time format from 01:20:00.000000 to "1 Hr 20 Mins"?

[jeffland · Accepted solution]

If you're looking for an easy way, you could go with

| eval output = replace(input, "0?(\d+):0?(h+).*", "\1 Hr \2 Min")

This replaces the entire content of the field (as the regex matches it entirely via .*) while capturing hours and minutes disregarding leading zeroes and outputs those numbers with fixed Hr and Min strings. I hope you see where this is going, if you wanted to add seconds it'd be

| eval output = replace(input, "0?(\d+):0?(h+):(\d+).*", "\1 Hr \2 Min \3 Sec")

and so on. You could also do it more elaborately by capturing those values with rex and creating a new field like this:

| rex field=input "0?(?<hours>\d+):0?(?<minutes>\d+)"
| eval output = hours . " Hr" . if(hours > 1, "s ", " ") . minutes . "Min" . if(minutes > 1, "s ", " ")

This allows you to add an "s" to Hr and Min if it's more than one.

[ashanka]

Is this possible?

[ashanka]

| eval startTime=strptime(startTime,"%Y-%m-%d %H:%M") 
| eval endTime=strptime(endTime,"%Y-%m-%d %H:%M") 
| eval MTTR=tostring((endTime-startTime),"duration")

This is how i got the duration