Splunk Search
Highlighted

How to parse a time duration of the format "4s", "9.1ms", etc.

New Member

The default duration output from go (golang) is to use a single float with one or two characters identifying the unit, ex:

56.920404ms
4.61µs
45.1s
etc.

I can't seem to find a built-in way to convert these. How can it be done?

0 Karma
Highlighted

Re: How to parse a time duration of the format "4s", "9.1ms", etc.

Legend

Try this, assuming that your duration output is in a field called duration

yoursearchhere
| convert rmunit(duration) as num_duration
| rex field=duration "\d*\s*(?<units>\w+)$"
| eval secs=num_duration * case(units=="s",1,  units="ms",.001, units="µs",.000001,units=="m",60,1==1,0)

The result is a field called secs that contains the duration converted to seconds.
Clearly, I did not do all possible units, but you get the point.
AFAIK, there is no single command or function that will do what you want. You could turn this into a macro though

0 Karma