I'm trying to convert a timestamp where my hour will go beyone 24 hours: for example: 305:44:03 The ctime and dur2sec don't seem to be handling this timeformat properly with either "%H:%M:%S or %H%H%H:%M:%S or %k:%M:%S. and so on...
Well you could carve it up yourself like this:
| eval val ="305:44:03"
| rex field=val "(?<hr>\d+):(?<min>\d+):(?<sec>\d+)"
| eval duration = (hr * 3600) + (min * 60) + sec
| table duration
All the best