How to convert time secs into HH:MM format?

[sekhar463]

Hai All,

from the below search  how to convert secs to HH:MM format 

age fields is getting time in secs

index=_internal source=*metrics.log group=tcpin_connections earliest=-2d@d
| eval Host=coalesce(hostname, sourceHost)
| eval age = (now() - _time )
| stats min(age) as age, max(_time) as LastTime by Host
| convert ctime(LastTime) as "Last Active On"
| eval Status= case(age < 1800,"Running",age > 1800,"DOWN") | rename age as Age
| sort Status | table Host, Status, Age,"Last Active On"

[sekhar463]

Hi Thanks,

this query i am using for to get UF status 

but query taking long time if i am trying to filter status =DOWN 

how we can modify this search fasten this query or how we can take time frame to get results

[gcusello]

Hi @sekhar463,

if your search is slow there could be two issues:

• very many data,
• you're using a slow storage.

for the first issue, you can accelerate your search in many ways, e.g. using a summary index.

For the second issue, remember that storage is the bottleneck of each Splunk system, and Splunk requires at least 800 (better 1200) IOPS for Hot and Warm Buckets, so the only solution is to use a faster storage.

Ciao.

Giuseppe

[gcusello]

Hi @sekhar463,

you can use eval tostring:

index=_internal source=*metrics.log group=tcpin_connections earliest=-2d@d
| eval Host=coalesce(hostname, sourceHost)
| eval age=(now()-_time)
| stats 
   min(age) AS age 
   max(_time) AS LastTime 
   BY Host
| convert ctime(LastTime) AS "Last Active On"
| eval Status=if(age< 1800,"Running","DOWN") 
| rename age AS Age
| eval Age=tostring(Age,"duration")
| sort Status 
| table Host Status Age "Last Active On"

Ciao.

Giuseppe