Splunk Search

## How to extract days ,hours minutes and secs??

Communicator

I have got the duration in this format 11+09:45:25.591549.I want to convert it to 11 days 9 hours 45 mins 25 secs.

Tags (3)
1 Solution
Legend

Here's one way...

| makeresults
| eval myfield1="11+09:45:25.591549"
| eval myfield2=myfield1
| rex mode=sed field=myfield2 "s/(\d+)\+(\d+):(\d+):(\d+).(\d+)/\1 days \2 hours \3 mins \4 secs/g"
| table myfield1 myfield2

Above method assumes you will always have all pieces. If you will occasionally have durations that are shorter than a day and have zero days, zero hours or whatever, then you need to define what you want to receive.

Legend

Here's one way...

| makeresults
| eval myfield1="11+09:45:25.591549"
| eval myfield2=myfield1
| rex mode=sed field=myfield2 "s/(\d+)\+(\d+):(\d+):(\d+).(\d+)/\1 days \2 hours \3 mins \4 secs/g"
| table myfield1 myfield2

Above method assumes you will always have all pieces. If you will occasionally have durations that are shorter than a day and have zero days, zero hours or whatever, then you need to define what you want to receive.

Communicator

Hi DalJeanis ,

There are some field values like this 00:00:10.000000 which I want to convert it to days , hours ,minutes and secs
Any way we can add " "00+" 00:00:10.000000"

Legend

That should be something like this

| makeresults
| eval myfield1="11+09:45:25.591549 00:00:10.000000"
| makemv myfield1
| mvexpand myfield1
| eval myfield2=myfield1
| rex mode=sed field=myfield2 "s/((\d+)\+)?(\d+):(\d+):(\d+).(\d+)/\2 days \3 hours \4 mins \5 secs/g s/^ /0 /g s/00/0/g"
| table myfield1 myfield2
Super Champion
rex field=<duration_field_name> "(?<DAYS>\d+).(?<Hours>\d+).(?<Mins>\d+).(?<Secs>\d+)"|table DAYS, Hours, Mins, Secs

replace <duration_field_name> with your duration field name

Get Updates on the Splunk Community!

#### Discover SplunkTrust and MVP Articles, Instant Translation, and More on Splunk ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

#### Integrating Kubernetes and Splunk Observability Cloud

We need end-to-end insight into our application environments to confidently ensure everything is up and ...

#### Index This | What has a tail and a head but no body?

July 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...