Splunk Search

Minutes and seconds formating

gravi
Explorer

I have a field that sends time in Min&sec in the format 3m7s

I want it to be in the format 3.07

Tried using the below eval but the result is null.

| eval ProcessingTime=strftime(strptime(DFLoadTime, "%M%S"),"%M.%S")

Could you please help?

Thanks

0 Karma

vnravikumar
Champion

Hi

Try this

| makeresults 
| eval temp="7h13m17s, 4m6s" 
| makemv delim="," temp 
| mvexpand temp 
| rex field=temp "((?P<hour>\d+)h){0,1}(?P<minutes>\d+)m(?P<seconds>\d+)s" 
| eval minutes = if(isnotnull(hour),((hour*60)+minutes),minutes) 
| eval result = minutes.".".printf("%02d",seconds) |table temp, result
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I think | eval ProcessingTime=strftime(strptime(DFLoadTime, "%Mm%Ss"),"%M.%S") will work.

---
If this reply helps you, Karma would be appreciated.
0 Karma

gravi
Explorer

This eval expression is returning nothing even if the input is in MmSs format

| eval ProcessingTime=strftime(strptime(DFLoadTime, "%Mm%Ss"),"%M.%S")

But if the fields is in HhMmSs the below eval expression is returng results in H.M.S format

| eval ProcessingTime=strftime(strptime(DFLoadTime, "%HhMm%Ss"),"%H.%M.%S")
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Let's try using rex to handle the optional hours value.

| makeresults
| eval time="34m56s" 
| rex field=time "(?:(?<hr>\d+)h)?(?<min>\d+)m(?<sec>\d+)s"
| eval hr=coalesce(hr,0)
| eval ProcessingTime=hr.":".min.":".sec
| convert dur2sec(ProcessingTime) 
| eval TimeinMin=(ProcessingTime)/60 
| table time, ProcessingTime,TimeinMin
---
If this reply helps you, Karma would be appreciated.
0 Karma

gravi
Explorer

Thnaks for the reply. I just realized that we have few results in MmSs format and few in HhMmSs format. It works if I have either of them but not both. Do you know if there is any generic wayto satisfy both scenarios?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...