Splunk Search

## How to edit my search to remove .000 from the end of a time field (HH:MM.000)?

Path Finder

I have a search that creates a time in `HH:MM` and looks like `04:34.000`. How can I drop the `.000` at the end of this? Here is the part of my search that gets the time.

``````| addinfo | eval duration=info_max_time-info_min_time | eval dur_formatted=tostring(duration, "duration") | eval HH:MM:SS=tostring('duration', "duration") | convert rmunit("duration") as numSecs  | eval "duration" = round('duration',0) | eval stringSecs2=tostring(numSecs,"duration") | eval "Total Time in HH:MM" = replace(stringSecs2,"(\d+)\:(\d+)\:(\d+)","\1:\2")
``````
Tags (5)
1 Solution
SplunkTrust

You could use `rtrim` to cut the last 3 digits

`... | eval stringSecs2 = rtrim(stringSecs2,substr(stringSecs2,-3))`

Builder

Would this work?

``````| eval "Total Time in HH:MM"=strptime("Total Time in HH:MM", "%H:%M")
``````

"strptime(X,Y) This function takes a time represented by a string, X, and parses it into a timestamp using the format specified by Y. For a list and descriptions of format options, refer to the topic "Common time format variables". If timeStr is in the form, "11:59", this returns it as a timestamp:"

SplunkTrust

You could use `rtrim` to cut the last 3 digits

`... | eval stringSecs2 = rtrim(stringSecs2,substr(stringSecs2,-3))`

Path Finder

That worked! thanks.

Legend

Try this

``````| addinfo | eval duration=info_max_time-info_min_time | eval dur_formatted=tostring(round(duration, 0), "duration") | table duration dur_formatted
``````
Path Finder

I could not get that to work. Were you say to replace what I had with that?

Legend

Replace you search with what I had

Path Finder