@chitreshakumar are you looking for something like the following?
| makeresults | eval durationInSec="12736,823321" | fields - _time | makemv durationInSec delim="," | mvexpand durationInSec | eval durationString=tostring(durationInSec,"duration")
If you are just looking for concatenating number of days to HH:MM:SS you can use eval with dot
(.) or plus
| makeresults | eval durationString="00:00:10.000000" | eval days="01" | eval durationString=days."+".durationString
If it is not one of the above, please share your current query and data to add more details.
@niketnilay Thanks for the reply !!! I want something like second one .Since I have days values in some duration field 11+09:45:25.591549 .And in some values it is having "HH:MM:SS" so I want to add days .
At first I need to match only those values having HH:MM:SS then add days to it.I think I am clear about the requirement .Let me know if you want me to elaborate more
Try like this (will add
00+ to duration if it doesn't have day notation)
your current search with duration field say with name "duration" | eval duration=if(match(duration,"^\d+\+",duration,"00+".duration)