I have duration 00:00:10.000000 i.e 00 hrs 00 mins 10 secs .But I want to add days also as my field has many values containing days also .SO is there any method to add " '00+' 00:00:10.000000" to the matched values "00:00:10.000000"??
Try like this (will add 00+
to duration if it doesn't have day notation)
your current search with duration field say with name "duration"
| eval duration=if(match(duration,"^\d+\+",duration,"00+".duration)
Try like this (will add 00+
to duration if it doesn't have day notation)
your current search with duration field say with name "duration"
| eval duration=if(match(duration,"^\d+\+",duration,"00+".duration)
@chitreshakumar - This one will work, or you can use the altered regex I put onto the other question.
@chitreshakumar are you looking for something like the following?
| makeresults
| eval durationInSec="12736,823321"
| fields - _time
| makemv durationInSec delim=","
| mvexpand durationInSec
| eval durationString=tostring(durationInSec,"duration")
If you are just looking for concatenating number of days to HH:MM:SS you can use eval with dot (.)
or plus (+)
| makeresults
| eval durationString="00:00:10.000000"
| eval days="01"
| eval durationString=days."+".durationString
If it is not one of the above, please share your current query and data to add more details.
@niketnilay Thanks for the reply !!! I want something like second one .Since I have days values in some duration field 11+09:45:25.591549 .And in some values it is having "HH:MM:SS" so I want to add days .
At first I need to match only those values having HH:MM:SS then add days to it.I think I am clear about the requirement .Let me know if you want me to elaborate more
@chitreshakumar, refer to answer by @somesoni2. I think that is what you need.