Below is a two result conversion table. The data I am given, some will have days in the field and others will only have time. How do I setup a conversion to handle this situation. The convert auto(UpTime) works great as long as the field contains an entry with days. The rex works well, again as long as the field contains a string containing days.
| makeresults
| eval UpTime="5:10:07:03.2419156"|append [|makeresults |eval UpTime="9:28:35.1006819"]
| convert auto(UpTime) AS autoDays
| rex field=UpTime "(?<days>\d+):(?<hours>\d+):(?<minutes>\d+):(?<seconds>\d+)\.(?<micro>\d+)"
| table UpTime, autoDays, days,hours,minutes, seconds, micro
Results:
UpTime autoDays days hours minutes seconds micro
5:10:07:03.2419156 5 5 10 07 03 2419156
9:28:35.1006819 9
Can you please try this?
| makeresults
| eval UpTime="5:10:07:03.2419156"|append [|makeresults |eval UpTime="9:28:35.1006819"]
| convert auto(UpTime) AS autoDays
| rex field=UpTime "((?<days>\d+):)?(?<hours>\d+):(?<minutes>\d+):(?<seconds>\d+)\.(?<micro>\d+)"
| table UpTime, autoDays, days,hours,minutes, seconds, micro
Thanks
KV
▄︻̷̿┻̿═━一
If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.
Can you please try this?
| makeresults
| eval UpTime="5:10:07:03.2419156"|append [|makeresults |eval UpTime="9:28:35.1006819"]
| convert auto(UpTime) AS autoDays
| rex field=UpTime "((?<days>\d+):)?(?<hours>\d+):(?<minutes>\d+):(?<seconds>\d+)\.(?<micro>\d+)"
| table UpTime, autoDays, days,hours,minutes, seconds, micro
Thanks
KV
▄︻̷̿┻̿═━一
If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.