Trying to dur2sec a HH field that is more than 24H

[wweiland]

I'm trying to dur2sec a hour field that is more than 24H and therefore doesn't work. Anyone have any suggestions on how I can get the seconds out of this type of HH:MM:SS?

Below is a sample output showing that below 24H works fine, everything above fails.

walltime wall
24:00:03

23:59:46 86386

[sowings]

I think dur2sec might be aimed at something like a sendmail (x)delay field, where values over 24 hours are converted to days+HH:MM:SS. I'd go with @kristian.kolb 's solution shown below.

[kristian_kolb · Accepted solution]

You can do it manually;

blah blah | rex field=your_time_field "(?<HH>\d+):(?<MM>\d+):(?<SS>\d+)" | eval dur = (HH * 3600) + (MM * 60) + SS | table your_time_field dur

/K

[wweiland]

Thank you for your help!

[wrighke]

Just want to add, if your timestamp included milliseconds, you can use:

| rex field=diff "(?\d+):(?\d+):(?\d+).(?\d+)"
| eval dur = (HH * 3600) + (MM * 60) + SS + (MS / 1000000)

my timestamp had 6 decimal places for ms, so I divide ms by 1,000,000