Is there a way to change the time duration calculated to a more readable format?

[splunkin11]

Is there a way to change the time duration calculated to a more readable format?

Trying to go from something like this : "40+09:01:43" to something more like "40 days + 09:01:43"

[sundareshr · Accepted solution]

This will work even if duration is less than 1 day.

.... | rex field=duration "((?<d>\d+)\+)?(?<t>.*)" | fillnull days value=0 | eval duration=d." days + ".t

[splunkin11]

Excellent! Thank you.

[gokadroid]

if say this data is in field myDate then how about using this below:

query to return myDate
| rex field=myDate "(?<days>[^\+]+)\+(?<myTime>.*)"
| eval completeTime=days." days + ".myTime
| tabe myDate, completeTime

See here the extraction