I want to generate a catogery wise Browsing time report per user. Here is my search given below :
host="192.xxx.xxx.xxx" user=* |transaction appcat| stats sum(duration) AS session_time sum(sentbyte) as sent sum(rcvdbyte) as received by appcat user
| eval browsing-time=tostring(session_time, "duration")
| eval TotalMB=round((sent+received)/1024/1024)
| table user,appcat,browsing-time,TotalMB | rename appcat as Category
I am able to generate report. but In the browsing-time i am getting value like 1+00:34:04 , 32+12:23:43, etc. I want this feild without days. I hope the format 1+00:34:04 is Days+hh:mm:sec. I want it in only time format. Is there any formula for that? Please help.
Try the following run anywhere search. I have created several separate fields for explaining the answers, you would need to get days and hours from duration string and then convert days to hours and sum with hours from duration string to get total hours. Finally prefix to the duration containing only Minute and Seconds.
PS: First two pipes are to create dummy data. Change duration in second pipe between 0, 10, 100, 1000, 10000, 100000 etc to verify expected output durationFinal