Splunk Search

## Time value difference in duration: getting value as 0d

Communicator

HI All,

I am able to get the time value difference in epoch and able to convert it to string with the following command:-

``````eval LeadDays = ( Answer_Time - Bookingdate) |  eval LeadDays = tostring(LeadDays, "duration") |

1535635518.000000   1535708751.000000   20:20:33.000000
1535636031.000000   1536059535.000000   2+21:38:24.000000
``````

The problem is in the first row: is there a way to convert it to 0+20:20:33.000000 instead of 20:20:33.000000

I tried to use string concat but it didnt work.

Also is there a way to convert 2+21:38:24 to only days as 2+21/24+38/3600= 2.88 days

Tags (5)
1 Solution
Motivator

try this:

``````| eval LeadDays = if(like(LeadDays,"%+%"), LeadDays, "0+".LeadDays)
| eval new_LeadDays = round(days + hours/24 + minutes/3600, 2)
| fields - days hours minutes
``````

Explanation:

1. first preppend a "0+" if the LeadDays doesn't contain a "+" in it
2. capture the days / hours / minutes into different fields
3. use the fields captured in #2 to calculate a new field as per your requirements
4. remove the unnecessary fields

Hope this helps

Motivator

try this:

``````| eval LeadDays = if(like(LeadDays,"%+%"), LeadDays, "0+".LeadDays)
| eval new_LeadDays = round(days + hours/24 + minutes/3600, 2)
| fields - days hours minutes
``````

Explanation:

1. first preppend a "0+" if the LeadDays doesn't contain a "+" in it
2. capture the days / hours / minutes into different fields
3. use the fields captured in #2 to calculate a new field as per your requirements
4. remove the unnecessary fields

Hope this helps

Communicator

THanks a lot for the answer.

Communicator

I was trying to use the match command in eval case and it was giving me issues. This one is working like a charm.

Did you miss .conf21 Virtual?

### Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE! Catch Up Now >>

Get Updates on the Splunk Community!