Spl query for host downtime consolidation

[Harikiranjammul]

I have a data like below

Servename     downtime

Web1               7 day 2 h

Web2                2 h 23 min

Web2               20 min

Web3.               17 min

Have  severname and downtime fields. Servernames can be same with different donwtime available.

How can I group this by servename by adding the downtimes in to single row of per server. Help us with spl query

[ITWhisperer]

Is the downtime already / previously available as a numeric e.g. number of seconds? If not, you would have to convert it to a numeric by parsing the string into its constituent parts and multiply until you have the number of seconds. You can then use stats with the sum aggregation function to calculate the total downtime for each host.

[Harikiranjammul]

Hi

I don't have the numeric field.

Any quick suggestion on converting this type of string to numeric field?

[ITWhisperer]

| rex field=downtime "((?<day>\d+)\sday\s?)?((?<hour>\d+)\sh\s?)?((?<minute>\d+)\smin\s?)?"
| fillnull value=0 day hour minute
| eval duration=((((day * 24) + hour) * 60) + minute) * 60