convert text into numbers - HH:MM:SS into minutes

[splunker30039]

I have a field 'vpn_duration' which is taken from the 'Duration:' value in an ASA syslog disconnect message.

The message looks like this:

May 26 15:15:56 cvpn.X.net May 26 2010 14:58:24: %ASA-4-113019: Group = XVPN, Username = userA, IP = 1.2.3.4, Session disconnected. Session Type: IPsec, Duration: 5h:06m:18s, Bytes xmt: 24875, Bytes rcv: 33036, Reason: Lost Service

I would like to take the value I get (5h:06m:18s) and convert it into minutes. So, in this case, my result would be 306.

How can I get this done?

[dwaddle]

I came up with almost the same thing as ftk, except my ASA has durations > 1d in the logs..

| rex field="_raw" "Duration: (?<dur_day>[0-9]+)?d? *(?<dur_hour>[0-9]+)h?:(?<dur_min>[0-9]+)m?" 
| eval connduration=(if(dur_day=="",0,dur_day)*1440)+(dur_hour * 60)+dur_min

[ftk · Accepted solution]

You can use something like the following search:

your search terms | rex "Duration: (?<hours>\d+)h:(?<minutes>\d+)m:(?<seconds>\d+)s" | eval duration_minutes = ((hours*60)+minutes+(seconds/60))