How to edit my search to remove .000 from the end of a time field (HH:MM.000)?

[chadman]

I have a search that creates a time in HH:MM and looks like 04:34.000. How can I drop the .000 at the end of this? Here is the part of my search that gets the time.

| addinfo | eval duration=info_max_time-info_min_time | eval dur_formatted=tostring(duration, "duration") | eval HH:MM:SS=tostring('duration', "duration") | convert rmunit("duration") as numSecs  | eval "duration" = round('duration',0) | eval stringSecs2=tostring(numSecs,"duration") | eval "Total Time in HH:MM" = replace(stringSecs2,"(\d+)\:(\d+)\:(\d+)","\1:\2")

[JDukeSplunk]

Would this work?

| eval "Total Time in HH:MM"=strptime("Total Time in HH:MM", "%H:%M")

"strptime(X,Y) This function takes a time represented by a string, X, and parses it into a timestamp using the format specified by Y. For a list and descriptions of format options, refer to the topic "Common time format variables". If timeStr is in the form, "11:59", this returns it as a timestamp:"

[skoelpin · Accepted solution]

You could use rtrim to cut the last 3 digits

... | eval stringSecs2 = rtrim(stringSecs2,substr(stringSecs2,-3))

[chadman]

That worked! thanks.

[sundareshr]

Try this

| addinfo | eval duration=info_max_time-info_min_time | eval dur_formatted=tostring(round(duration, 0), "duration") | table duration dur_formatted

[chadman]

I could not get that to work. Were you say to replace what I had with that?

[sundareshr]

Replace you search with what I had

[chadman]

when I did that I get "no results found"