I'm trying to dur2sec a hour field that is more than 24H and therefore doesn't work. Anyone have any suggestions on how I can get the seconds out of this type of HH:MM:SS?
Below is a sample output showing that below 24H works fine, everything above fails.
You can do it manually;
blah blah | rex field=your_time_field "(?<HH>\d+):(?<MM>\d+):(?<SS>\d+)" | eval dur = (HH * 3600) + (MM * 60) + SS | table your_time_field dur
Just want to add, if your timestamp included milliseconds, you can use:
| rex field=diff "(?\d+):(?\d+):(?\d+).(?\d+)"
| eval dur = (HH * 3600) + (MM * 60) + SS + (MS / 1000000)
my timestamp had 6 decimal places for ms, so I divide ms by 1,000,000
I think dur2sec might be aimed at something like a sendmail (x)delay field, where values over 24 hours are converted to days+HH:MM:SS. I'd go with @kristian.kolb 's solution shown below.