I extracted deployment time from events and it's currently in this format 0:04.645
and 1:30.123
and is in terms of Minutes, Seconds, Milliseconds. I need to sum this time up every day and graph it.
How can I put this in a time format in seconds?
Example:
0:04.645
1:30.123
sum = 94.768 seconds
Use the strptime command.
... |eval atime=strptime(fieldname, "%M:%S.%3N")
You need the tostring
like this:
... | rex field=field1 "(?<H>.*?))?:?((?<M>.*?))?:?(?<S>.*?)" | fillnull value=0 | eval onlySeconds1 = S + 60*(M + 60*H) | rex field=field2 "(?<H>.*?))?:?((?<M>.*?))?:?(?<S>.*?)" | fillnull value=0 | eval onlySeconds2 = S + 60*(M + 60*H) | eval =sumSeconds = onlySeconds1 + onlySeconds2 | eval sumTime = tostring(sumSeconds, "duration")
Use the strptime command.
... |eval atime=strptime(fieldname, "%M:%S.%3N")
Does this really work? First of all, it is not syntactically correct (missing eval
). Secondly it generates a time_t
, not a duration.