How to insert the values if match is found?

[chitreshakumar]

I have duration 00:00:10.000000 i.e 00 hrs 00 mins 10 secs .But I want to add days also as my field has many values containing days also .SO is there any method to add " '00+' 00:00:10.000000" to the matched values "00:00:10.000000"??

[somesoni2 · Accepted solution]

Try like this (will add 00+ to duration if it doesn't have day notation)

your current search with duration field say with name "duration"
| eval duration=if(match(duration,"^\d+\+",duration,"00+".duration)

[DalJeanis]

@chitreshakumar - This one will work, or you can use the altered regex I put onto the other question.

[niketn]

@chitreshakumar are you looking for something like the following?

| makeresults
| eval durationInSec="12736,823321"
| fields - _time
| makemv durationInSec delim=","
| mvexpand durationInSec
| eval durationString=tostring(durationInSec,"duration")

If you are just looking for concatenating number of days to HH:MM:SS you can use eval with dot (.) or plus (+)

| makeresults
| eval durationString="00:00:10.000000"
| eval days="01"
| eval durationString=days."+".durationString

If it is not one of the above, please share your current query and data to add more details.

[chitreshakumar]

@niketnilay Thanks for the reply !!! I want something like second one .Since I have days values in some duration field 11+09:45:25.591549 .And in some values it is having "HH:MM:SS" so I want to add days .
At first I need to match only those values having HH:MM:SS then add days to it.I think I am clear about the requirement .Let me know if you want me to elaborate more

[niketn]

@chitreshakumar, refer to answer by @somesoni2. I think that is what you need.