Splunk Search

how to extract time from a string time field?

matansocher
Contributor

I have that field that shows time in a string. the values of the field are something like:
alt text

Is there a way to extract the number of hours for each one?
for example if I have value of 2 days I will get 16 hours (8 hours a day), and if I have 30 minutes value, I will get 0.5 hours.

Thank you

0 Karma
1 Solution

dineshraj9
Builder

Create 3 new fields from this existing field and then calculate hours -

| rex field=<existing_field> "(?<DAYS>\d+)\s*Day"
| rex field=<existing_field> "(?<HOURS>\d+)\s*Hour"
| rex field=<existing_field> "(?<MINS>\d+)\s*Minute"
| eval FINAL_TIME=8*DAYS + HOURS + round(MINS/60,2)

View solution in original post

dineshraj9
Builder

Create 3 new fields from this existing field and then calculate hours -

| rex field=<existing_field> "(?<DAYS>\d+)\s*Day"
| rex field=<existing_field> "(?<HOURS>\d+)\s*Hour"
| rex field=<existing_field> "(?<MINS>\d+)\s*Minute"
| eval FINAL_TIME=8*DAYS + HOURS + round(MINS/60,2)

matansocher
Contributor

I think that might be really helpful for me, but I get no results in the FINAL_TIME field. I think it happens because the values does not contain days hours and minutes, only 1 or 2 of them on each value. I think I need to check if for example "Days" exists in the field and only then try to extract it. what is the best way to do it?
Thank you!

0 Karma

dineshraj9
Builder

This will work -

   | rex field=<existing_field> "(?<DAYS>\d+)\s*Day"
    | rex field=<existing_field> "(?<HOURS>\d+)\s*Hour"
    | rex field=<existing_field> "(?<MINS>\d+)\s*Minute"
    | eval DAYS=if(isnull(DAYS),0,DAYS) | eval HOURS=if(isnull(HOURS),0,HOURS) | eval MINS=if(isnull(MINS),0,MINS) 
    | eval FINAL_TIME=8*DAYS + HOURS + round(MINS/60,2)
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...