Uptime Conversion

[cinsley]

Below is a two result conversion table.  The data I am given, some will have days in the field and others will only have time.  How do I setup a conversion to handle this situation.  The convert auto(UpTime) works great as long as the field contains an entry with days.  The rex works well, again as long as the field contains a string containing days.

| makeresults
| eval UpTime="5:10:07:03.2419156"|append [|makeresults |eval UpTime="9:28:35.1006819"]
| convert auto(UpTime) AS autoDays
| rex field=UpTime "(?<days>\d+):(?<hours>\d+):(?<minutes>\d+):(?<seconds>\d+)\.(?<micro>\d+)"
| table UpTime, autoDays, days,hours,minutes, seconds, micro

Results:

UpTime                            autoDays  days    hours   minutes seconds              micro 

5:10:07:03.2419156                5           5         10             07            03          2419156
9:28:35.1006819                      9

[cinsley]

That was the solution.   Thanks

[kamlesh_vaghela]

Glad to help you

Happy Splunking

[kamlesh_vaghela · Accepted solution]

@cinsley 

Can you please try this?

| makeresults
| eval UpTime="5:10:07:03.2419156"|append [|makeresults |eval UpTime="9:28:35.1006819"]
| convert auto(UpTime) AS autoDays
| rex field=UpTime "((?<days>\d+):)?(?<hours>\d+):(?<minutes>\d+):(?<seconds>\d+)\.(?<micro>\d+)"
| table UpTime, autoDays, days,hours,minutes, seconds, micro

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.