I have a search that creates a time in
HH:MM and looks like
04:34.000. How can I drop the
.000 at the end of this? Here is the part of my search that gets the time.
| addinfo | eval duration=info_max_time-info_min_time | eval dur_formatted=tostring(duration, "duration") | eval HH:MM:SS=tostring('duration', "duration") | convert rmunit("duration") as numSecs | eval "duration" = round('duration',0) | eval stringSecs2=tostring(numSecs,"duration") | eval "Total Time in HH:MM" = replace(stringSecs2,"(\d+)\:(\d+)\:(\d+)","\1:\2")
| addinfo | eval duration=info_max_time-info_min_time | eval dur_formatted=tostring(round(duration, 0), "duration") | table duration dur_formatted
You could use
rtrim to cut the last 3 digits
... | eval stringSecs2 = rtrim(stringSecs2,substr(stringSecs2,-3))
Would this work?
| eval "Total Time in HH:MM"=strptime("Total Time in HH:MM", "%H:%M")
"strptime(X,Y) This function takes a time represented by a string, X, and parses it into a timestamp using the format specified by Y. For a list and descriptions of format options, refer to the topic "Common time format variables". If timeStr is in the form, "11:59", this returns it as a timestamp:"