Splunk Search

Minutes and seconds formating

gravi
Explorer

I have a field that sends time in Min&sec in the format 3m7s

I want it to be in the format 3.07

Tried using the below eval but the result is null.

| eval ProcessingTime=strftime(strptime(DFLoadTime, "%M%S"),"%M.%S")

Could you please help?

Thanks

0 Karma

vnravikumar
Champion

Hi

Try this

| makeresults 
| eval temp="7h13m17s, 4m6s" 
| makemv delim="," temp 
| mvexpand temp 
| rex field=temp "((?P<hour>\d+)h){0,1}(?P<minutes>\d+)m(?P<seconds>\d+)s" 
| eval minutes = if(isnotnull(hour),((hour*60)+minutes),minutes) 
| eval result = minutes.".".printf("%02d",seconds) |table temp, result
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I think | eval ProcessingTime=strftime(strptime(DFLoadTime, "%Mm%Ss"),"%M.%S") will work.

---
If this reply helps you, Karma would be appreciated.
0 Karma

gravi
Explorer

This eval expression is returning nothing even if the input is in MmSs format

| eval ProcessingTime=strftime(strptime(DFLoadTime, "%Mm%Ss"),"%M.%S")

But if the fields is in HhMmSs the below eval expression is returng results in H.M.S format

| eval ProcessingTime=strftime(strptime(DFLoadTime, "%HhMm%Ss"),"%H.%M.%S")
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Let's try using rex to handle the optional hours value.

| makeresults
| eval time="34m56s" 
| rex field=time "(?:(?<hr>\d+)h)?(?<min>\d+)m(?<sec>\d+)s"
| eval hr=coalesce(hr,0)
| eval ProcessingTime=hr.":".min.":".sec
| convert dur2sec(ProcessingTime) 
| eval TimeinMin=(ProcessingTime)/60 
| table time, ProcessingTime,TimeinMin
---
If this reply helps you, Karma would be appreciated.
0 Karma

gravi
Explorer

Thnaks for the reply. I just realized that we have few results in MmSs format and few in HhMmSs format. It works if I have either of them but not both. Do you know if there is any generic wayto satisfy both scenarios?

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...