Splunk Search

Minutes and seconds formating

gravi
Explorer

I have a field that sends time in Min&sec in the format 3m7s

I want it to be in the format 3.07

Tried using the below eval but the result is null.

| eval ProcessingTime=strftime(strptime(DFLoadTime, "%M%S"),"%M.%S")

Could you please help?

Thanks

0 Karma

vnravikumar
Champion

Hi

Try this

| makeresults 
| eval temp="7h13m17s, 4m6s" 
| makemv delim="," temp 
| mvexpand temp 
| rex field=temp "((?P<hour>\d+)h){0,1}(?P<minutes>\d+)m(?P<seconds>\d+)s" 
| eval minutes = if(isnotnull(hour),((hour*60)+minutes),minutes) 
| eval result = minutes.".".printf("%02d",seconds) |table temp, result
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I think | eval ProcessingTime=strftime(strptime(DFLoadTime, "%Mm%Ss"),"%M.%S") will work.

---
If this reply helps you, Karma would be appreciated.
0 Karma

gravi
Explorer

This eval expression is returning nothing even if the input is in MmSs format

| eval ProcessingTime=strftime(strptime(DFLoadTime, "%Mm%Ss"),"%M.%S")

But if the fields is in HhMmSs the below eval expression is returng results in H.M.S format

| eval ProcessingTime=strftime(strptime(DFLoadTime, "%HhMm%Ss"),"%H.%M.%S")
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Let's try using rex to handle the optional hours value.

| makeresults
| eval time="34m56s" 
| rex field=time "(?:(?<hr>\d+)h)?(?<min>\d+)m(?<sec>\d+)s"
| eval hr=coalesce(hr,0)
| eval ProcessingTime=hr.":".min.":".sec
| convert dur2sec(ProcessingTime) 
| eval TimeinMin=(ProcessingTime)/60 
| table time, ProcessingTime,TimeinMin
---
If this reply helps you, Karma would be appreciated.
0 Karma

gravi
Explorer

Thnaks for the reply. I just realized that we have few results in MmSs format and few in HhMmSs format. It works if I have either of them but not both. Do you know if there is any generic wayto satisfy both scenarios?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...