calculate sum of duration

[g_paternicola]

Hi everyone,

I have calculated a duration field like this for example

Duration
00:22:02
00:19:26
00:04:26
00:20:16
00:16:47

with this search

my_search | convert num("Duration") | stats sum("Duration") as "Total" | eval "Total"=tostring($Total$,"duration")

and I have the result of  this in a total of all my durations

5+17:02:53

I there a way to convert or transform this result in 
5 days
17 hours
02 minutes
53 seconds

or something like this would also be great:

5 days 17:02:53'

Thank you very much!

[richgalloway]

There is no built-in function to do that so you'll have to do it manually.  Start with a simple replace:

| replace "+" with " days " in Total

For something a little more complex, try rex:

| rex field=Total "(?:(?<days>\d+)\+)?(?<hours>\d+):(?<minutes>\d+):(?<seconds>\d+)"
| eval Total = if(isnull(days),0,days)." days ".hours." hours ".minutes." minutes ".seconds." seconds"

[ITWhisperer · Accepted solution]

Split into two rex in case the duration is not more than 1 day.

| rex field=Total mode=sed "s/\+/ days /g"
| rex field=Total mode=sed "s/(\d\d):(\d\d):(\d\d)/\1 hours \2 minutes \3 seconds/g"