Need Minutes and hours conversion

[priya1926]

Hi,

I am trying this cmd 

 index="wineventlog" host IN (*) EventCode=6006 OR EventCode="6005" Type=Information
| transaction host startswith=6006 endswith=6005 maxevents=2
| eval duration = duration + " Sec"
| table _time host duration

If the output in sec.. i need sec... if its in minutes then minutes .. if its in hours and if in days it should calculate the same.

Thanks in Advance

[skrajkumar_splu]

Or you can try converting the duration to string and then add sec, mins via regex like below example

| eval duration=tostring(duration,"duration")| eval time_taken = replace(duration,"(\d+)\:(\d+)\:(\d+)","\1h \2min \3sec")

[Random_Walk]

I think this will help ...

index=wineventlog EventCode=6006 OR EventCode="6005" Type=Information
| transaction host startswith=6006 endswith=6005 maxevents=2
| eval Units=case(duration<60, " Sec", duration<3600, " Min", duration<86400, " Hours", duration>86400, " Days")
| eval Duration=case(duration<60, duration, duration<3600, duration/60, duration<86400, duration/3600, duration>86400, duration/86400)
| table _time host duration Duration Units