How to extract the duration in seconds from values like "2 dy 13 hr 49 min 13 sec"

[HeinzWaescher]

Hi,

I would like to extract the duration in seconds from values like these:
"2 dy 13 hr 49 min 13 sec"
"1 hr 49 min 41 sec"
"12 min 56 sec"

For constant values (e.g. with only min & sec) I would use:
"12 min 56 sec" -> | rex field="FieldA" "(?.*)\ (?.*)\ (?.*) (?.*)"

But as you can see, the format can be different. Is possible to convert these fields into a duration in seconds?

My idea would be to extract fields for each part of the value, for example:

"2 dy 13 hr 49 min 13 sec" into:

dy=2
hr=13
min=49
sec=13

But I don't know how to achieve this. Can you help me?

Thanks in advance
Heinz

[sundareshr · Accepted solution]

Try this

.... | eval duration= replace(duration,"(\d*)+?(\d+):(\d+):(\d+)","\1dy \2hr \3min \4sec")

[HeinzWaescher]

Thanks for your suggestion. I'm not sure what is intended by this command, adding it just copies the field.

duration="14 hr 22 min 44 sec" -> new duration="14 hr 22 min 44 sec"

[sundareshr]

LOL. I clearly misunderstood your question. Here, I think I know now, what you are looking for. Try this runanywhere sample

| gentimes start=-1 | eval duration="49 min 13 sec" | rex field=duration "((?<dy>\d+)\sdy\s)?((?<hr>\d+)\shr\s)?((?<min>\d+)\smin\s)?((?<sec>\d+)\ssec)?" | eval dy=coalesce(dy, 0) | eval hr=coalesce(hr, 0) | eval min=coalesce(min, 0) | eval sec=coalesce(sec, 0) | eval duration=(dy*(3600*24)) + (hr*(3600)) + (min*60) + sec | eval dur=tostring(duration, "duration") | table dy hr min sec duration dur

[HeinzWaescher]

Awesome, this works fine 🙂
Thanks a lot

[jmallorquin]

Hi HeinzWasecher,

Have you try to use separate extractions like:

props.conf
EXTRACT-dias = \s(?<days>[^\s]+)\sdy
EXTRACT-horas = \s(?<hours>[^\s]+)\shr
...

And in the search make a fillnull of all the fields and make an eval with the calculation

|fillnull days hours .... value=0
| eval Totalsec = days*86400 + hours*3600 ....

Hope i help you

[HeinzWaescher]

Thanks for your answer. I'm using a csv with inputlookup here, so I think I have to do it at search time?

[jmallorquin]

Hi,

Yes. I that case it will be
| rex "\s(?[^\s]+)\sdy" |rex "\s(?[^\s]+)\shr" ....

Hope i help you

[HeinzWaescher]

This results in an error:

Error in 'rex' command: Encountered the following error while compiling the regex '\s(?[^\s]+)\sdy': Regex: unrecognized character after (? or (?-

[jmallorquin]

Hi,

Sorry I didn't quote and the command was malformed

The correct is :

| rex "\s(?<days>[^\s]+)\sdy" |rex "\s(?<hours>[^\s]+)\shr" ....<-- continue with the rest of the fields
|fillnull days hours .... value=0
| eval Totalsec = days*86400 + hours*3600 ....